Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.

Bug 1406314 (CVE-2016-1254)

Summary:	CVE-2016-1254 tor: Remote DoS via parsing problem
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	lewk, pwouters, s
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	tor 0.2.8.12, tor 0.2.9.8	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-03-03 14:31:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1406316, 1406317
Bug Blocks:

Description Andrej Nemec 2016-12-20 09:12:41 UTC

It was found that there is an issue with parsing that could ause clients to read a single byte past the end of an allocated region. This bug could be used to cause hardened clients (built with --enable-expensive-hardening) to crash if they tried to visit a hostile hidden service. Non-hardened clients are only affected depending on the details of their platform's memory allocator.

External References:

https://lists.torproject.org/pipermail/tor-announce/2016-December/000122.html

Upstream patch:

https://gitweb.torproject.org/tor.git/commit/?id=d978216dea6b21ac38230a59d172139185a68dbd

Comment 1 Andrej Nemec 2016-12-20 09:14:08 UTC

Created tor tracking bugs for this issue:

Affects: fedora-all [bug 1406316]
Affects: epel-all [bug 1406317]