PT-2007-5369 · Tor · Tor

Published 2007-08-07 · Updated 2017-07-29 · CVE-2007-4174

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Tor versions prior to 0.1.2.16

Description The issue allows remote attackers to modify the torrc configuration file and compromise anonymity. This can be achieved by sending HTTP POST data containing commands without valid authentication. For example, an attacker could use an HTML form hosted on a web site or inject malicious content as a Tor exit node.

Recommendations For Tor versions prior to 0.1.2.16, update to version 0.1.2.16 or later to resolve the issue. As a temporary workaround, consider disabling the ControlPort to minimize the risk of exploitation. Restrict access to the torrc configuration file to prevent unauthorized modifications.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2007-4174

Affected Products

Tor

References · 15

• 🔥 https://exploit-db.com/exploits/30447 · Exploit
• 🔥 https://exploit-db.com/exploits/4468 · Exploit
• http://secunia.com/advisories/26301 · Vendor Advisory
• http://vupen.com/english/advisories/2007/2768 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-4174 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-4174 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-4174 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-4174 · Vendor Advisory
• http://archives.seul.org/or/announce/Sep-2007/msg00000.html · Note
• http://securityfocus.com/bid/25188 · Note
• http://archives.seul.org/or/announce/Aug-2007/msg00000.html · Note
• http://securitytracker.com/id?1018510 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35784 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36407 · Note
• http://osvdb.org/36271 · Note