svn commit: r363515 - head/security/vuxml

Wed Jul 30 20:54:22 UTC 2014

Author: cs
Date: Wed Jul 30 20:54:21 2014
New Revision: 363515
URL: http://svnweb.freebsd.org/changeset/ports/363515
QAT: https://qat.redports.org/buildarchive/r363515/

Log:
  tor -- traffic confirmation attack

Modified:
  head/security/vuxml/vuln.xml

Modified: head/security/vuxml/vuln.xml
==============================================================================

--- head/security/vuxml/vuln.xml	Wed Jul 30 20:26:21 2014	(r363514)
+++ head/security/vuxml/vuln.xml	Wed Jul 30 20:54:21 2014	(r363515)
@@ -57,6 +57,42 @@ Notes:
 
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+  <vuln vid="31c09848-1829-11e4-bf04-60a44c524f57">
+    <topic>tor -- traffic confirmation attack</topic>
+    <affects>
+      <package>
+	<name>tor</name>
+	<range><lt>0.2.4.23</lt></range>
+      </package>
+      <package>
+	<name>tor-devel</name>
+	<range><lt>0.2.5.6.a</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>The Tor Project reports:</p>
+	<blockquote cite="https://lists.torproject.org/pipermail/tor-announce/2014-July/000094.html">
+	  <p>Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a
+	    circuit after an inbound RELAY_EARLY cell is received by a client,
+	    which makes it easier for remote attackers to conduct
+	    traffic-confirmation attacks by using the pattern of RELAY and
+	    RELAY_EARLY cells as a means of communicating information about
+	    hidden service names.</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <url>https://lists.torproject.org/pipermail/tor-announce/2014-July/000094.html</url>
+      <url>https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack</url>
+      <cvename>CVE-2014-5117</cvename>
+    </references>
+    <dates>
+      <discovery>2014-07-30</discovery>
+      <entry>2014-07-30</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="13419364-1685-11e4-bf04-60a44c524f57">
     <topic>i2p -- Multiple Vulnerabilities</topic>
     <affects>
