PT-2020-7822 · Tor+1 · Tor+1

Published 2015-03-22 · Updated 2024-06-15 · CVE-2015-2689

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Tor versions prior to 0.2.4.26 Tor versions 0.2.5.x prior to 0.2.5.11

Description: The issue arises from improper handling of pending-connection resolve states during periods of high DNS load. This allows remote attackers to cause a denial of service, resulting in an assertion failure and daemon exit, via crafted packets.

Recommendations: For Tor versions prior to 0.2.4.26, update to version 0.2.4.26 or later. For Tor versions 0.2.5.x prior to 0.2.5.11, update to version 0.2.5.11 or later.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2015-1317

CVE-2015-2689

DLA-178-1

DSA-3203-1

OPENSUSE-SU-2024:10423-1

Affected Products

Alt Linux

Tor

References · 34

• https://osv.dev/vulnerability/DEBIAN-CVE-2015-2689 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-2689 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10423-1 · Vendor Advisory
• https://lists.torproject.org/pipermail/tor-talk/2015-March/037281.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-2689 · Security Note
• https://ubuntu.com/security/CVE-2015-2689 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-2689 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-2689 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-2689 · Vendor Advisory
• https://trac.torproject.org/projects/tor/ticket/14129 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3203-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2012-3518 · Note
• https://suse.com/security/cve/CVE-2012-3517 · Note
• https://suse.com/security/cve/CVE-2011-4895 · Note
• https://suse.com/security/cve/CVE-2015-2688 · Note