CVE-2007-4174 Tor before 0.1.2.16, when ControlPort is enabled, does not properly restrict commands to localhost port 9051, which allows remote attackers to modify the torrc configuration file, compromise anonymity...
MediumCVSS 5.8
EPSS 6.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Tor before 0.1.2.16, when ControlPort is enabled, does not properly restrict commands to localhost port 9051, which allows remote attackers to modify the torrc configuration file, compromise anonymity, and have other unspecified impact via HTTP POST data containing commands without valid authentication, as demonstrated by an HTML form (1) hosted on a web site or (2) injected by a Tor exit node.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tor | <= 0.1.2.15 | No fix listed |
| tor | = 0.1.2.1-alpha | No fix listed |
| tor | = 0.1.2.2 | No fix listed |
| tor | = 0.1.2.3-alpha | No fix listed |
| tor | = 0.1.2.4 | No fix listed |
| tor | = 0.1.2.5 | No fix listed |
| tor | = 0.1.2.5-alpha | No fix listed |
| tor | = 0.1.2.6-alpha | No fix listed |
| tor | = 0.1.2.7-alpha | No fix listed |
| tor | = 0.1.2.8-beta | No fix listed |
| tor | = 0.1.2.9 | No fix listed |
| tor | = 0.1.2.10 | No fix listed |
| tor | = 0.1.2.11 | No fix listed |
| tor | = 0.1.2.12 | No fix listed |
| tor | = 0.1.2.13 | No fix listed |
| tor | = 0.1.2.14 | No fix listed |
| debian/tor(Debian:12) | < 0.1.2.16-1 | 0.1.2.16-1 |
| debian/tor(Debian:13) | < 0.1.2.16-1 | 0.1.2.16-1 |
| debian/tor(Debian:14) | < 0.1.2.16-1 | 0.1.2.16-1 |
References
- [or-announce] 20070802 Tor 0.1.2.16 is released mailing-list
- [or-announce] 20070901 Tor security advisory: cross-protocol http form attack mailing-list
- 36271 vdb-entry
- 26301 third-party-advisory vendor-advisory
- 25188 vdb-entry
- 1018510 vdb-entry
- ADV-2007-2768 vdb-entry vendor-advisory
- tor-controlport-security-bypass(35784) vdb-entry
- tor-control-command-execution(36407) vdb-entry
- Debian Security Tracker CVE-2007-4174 vendor-advisory