Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 597524 (CVE-2016-8860) - <net-misc/tor-0.2.8.9: Denial of Service
Summary: <net-misc/tor-0.2.8.9: Denial of Service
Status: RESOLVED FIXED
Alias: CVE-2016-8860
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://blog.torproject.org/blog/tor-...
Whiteboard: B3 [glsa cve glsa blocked]
Keywords:
: 597594 (view as bug list)
Depends on: 597394
Blocks:
  Show dependency tree
 
Reported: 2016-10-19 12:19 UTC by Agostino Sarubbo
Modified: 2016-12-24 06:51 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2016-10-19 12:19:16 UTC
From ${URL} :

Major features (security fixes, also in 0.2.9.4-alpha):
Prevent a class of security bugs caused by treating the contents of a buffer chunk as if they were a NUL-terminated string. At least one such bug seems 
to be present in all currently used versions of Tor, and would allow an attacker to remotely crash most Tor instances, especially those compiled with 
extra compiler hardening. With this defense in place, such bugs can't crash Tor, though we should still fix them as they occur. Closes ticket 20384 
(TROVE-2016-10-001).


@maintainer(s): since the fixed package is already in the tree, please let us know if it is ready for the stabilization or not.
Comment 1 Anthony Basile gentoo-dev 2016-10-19 18:00:02 UTC
(In reply to Agostino Sarubbo from comment #0)
> From ${URL} :
> 
> Major features (security fixes, also in 0.2.9.4-alpha):
> Prevent a class of security bugs caused by treating the contents of a buffer
> chunk as if they were a NUL-terminated string. At least one such bug seems 
> to be present in all currently used versions of Tor, and would allow an
> attacker to remotely crash most Tor instances, especially those compiled
> with 
> extra compiler hardening. With this defense in place, such bugs can't crash
> Tor, though we should still fix them as they occur. Closes ticket 20384 
> (TROVE-2016-10-001).
> 
> 
> @maintainer(s): since the fixed package is already in the tree, please let
> us know if it is ready for the stabilization or not.

I already have a stabilization request going in bug #597394
Comment 2 ncl 2016-10-20 07:04:07 UTC
*** Bug 597594 has been marked as a duplicate of this bug. ***
Comment 3 Kristian Fiskerstrand gentoo-dev 2016-11-04 19:16:19 UTC
Here, we will assign the ID to the broadest possible interpretation of
the issue, which perhaps can be restated as "Tor internal functions
were entitled to expect that buf_t data had NUL termination, but the
implementation of or/buffers.c did not ensure that NUL termination was
present."

Use CVE-2016-8860.

With this CVE, any related "we should still fix them as they occur"
patches can most likely be treated as defense-in-depth changes, and
won't require separate CVE IDs.
Comment 4 GLSAMaker/CVETool Bot gentoo-dev 2016-12-24 06:51:18 UTC
This issue was resolved and addressed in
 GLSA 201612-45 at https://security.gentoo.org/glsa/201612-45
by GLSA coordinator Aaron Bauman (b-man).