PT-2009-4843 · Tor · Tor

Optimist · Published 2009-07-10 · Updated 2017-08-17 · CVE-2009-2426

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Tor versions 0.1.x through 0.1.2.8-beta Tor versions 0.2.x through 0.2.0.35

Description The connection edge process relay cell not open function in src/or/relay.c allows exit relays to have an unspecified impact by causing controllers to accept DNS responses that redirect to an internal IP address via unknown vectors.

Recommendations For Tor versions 0.1.x through 0.1.2.8-beta, update to version 0.1.2.8-beta or later. For Tor versions 0.2.x through 0.2.0.35, update to version 0.2.0.35 or later.

Fix

Related Identifiers

CVE-2009-2426

Affected Products

Tor

References · 11

• http://archives.seul.org/or/announce/Jun-2009/msg00000.html · Patch
• http://securityfocus.com/bid/35505 · Patch
• http://osvdb.org/55341 · Patch
• http://vupen.com/english/advisories/2009/1716 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2426 · Security Note
• http://secunia.com/advisories/35546 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-2426 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-2426 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-2426 · Vendor Advisory
• http://xforce.iss.net/xforce/xfdb/51377 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51377 · Note