PT-2015-7573 · Tor · Tails

Tomtidaly · Published 2015-12-27 · Updated 2024-06-15 · CVE-2015-7665

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tails versions prior to 1.7

Description The issue allows remote FTP servers to discover the Tor client IP address by reading a PORT or EPRT command. This occurs because Tails does not prevent automatic fallback from passive FTP to active FTP when using the wget program.

Recommendations For versions prior to 1.7, consider updating to version 1.7 or later to resolve the issue. As a temporary workaround, restrict the use of the wget program for FTP connections to minimize the risk of IP address exposure.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-7665

OPENSUSE-SU-2024:10263-1

Affected Products

Tails

References · 15

• https://osv.dev/vulnerability/openSUSE-SU-2024:10263-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-7665 · Security Note
• https://tails.boum.org/news/version_1.7/index.en.html · Vendor Advisory
• https://mailman.boum.org/pipermail/tails-dev/2015-October/009591.html · Note
• https://mailman.boum.org/pipermail/tails-dev/2015-August/009370.html · Note
• https://suse.com/security/cve/CVE-2012-4929 · Note
• http://git.savannah.gnu.org/cgit/wget.git/commit/?id=075d7556964f5a871a73c22ac4b69f5361295099 · Note
• https://lists.gnu.org/archive/html/bug-wget/2015-08/msg00020.html · Note
• http://securityfocus.com/bid/76678 · Note
• https://suse.com/security/cve/CVE-2010-2252 · Note
• https://suse.com/security/cve/CVE-2014-4877 · Note
• https://suse.com/security/cve/CVE-2015-7665 · Note
• https://suse.com/security/cve/CVE-2016-4971 · Note
• https://labs.riseup.net/code/issues/10364 · Note
• http://openwall.com/lists/oss-security/2015/10/01/10 · Note