Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2011-2769 | First vendor Publication | 2011-12-22 |
| Vendor | Cve | Last vendor Modification | 2012-01-19 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:P/I:N/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 4.3 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Tor before 0.2.2.34, when configured as a bridge, accepts the CREATE and CREATE_FAST values in the Command field of a cell within an OR connection that it initiated, which allows remote relays to enumerate bridges by using these values. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2769 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-200 | Information Exposure |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:14939 | |||
| Oval ID: | oval:org.mitre.oval:def:14939 | ||
| Title: | DSA-2331-1 tor -- several | ||
| Description: | It has been discovered by "frosty_un" that a design flaw in Tor, an online privacy tool, allows malicious relay servers to learn certain information that they should not be able to learn. Specifically, a relay that a user connects to directly could learn which other relays that user is connected to directly. In combination with other attacks, this issue can lead to deanonymizing the user. The Common Vulnerabilities and Exposures project has assigned CVE-2011-2768 to this issue. In addition to fixing the above mentioned issues, the updates to oldstable and stable fix a number of less critical issues. Please see this posting from the Tor blog for more information: https://blog.torproject.org/blog/tor-02234-released-security-patches | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2331-1 CVE-2011-2768 CVE-2011-2769 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | tor |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-04-02 | Name : Fedora Update for tor FEDORA-2011-17248 File : nvt/gb_fedora_2011_17248_tor_fc16.nasl |
| 2012-03-19 | Name : Fedora Update for tor FEDORA-2011-15208 File : nvt/gb_fedora_2011_15208_tor_fc16.nasl |
| 2012-02-12 | Name : Gentoo Security Advisory GLSA 201201-12 (Tor) File : nvt/glsa_201201_12.nasl |
| 2012-02-11 | Name : Debian Security Advisory DSA 2331-1 (tor) File : nvt/deb_2331_1.nasl |
| 2011-11-08 | Name : Fedora Update for tor FEDORA-2011-15117 File : nvt/gb_fedora_2011_15117_tor_fc15.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 76630 | Tor TLS Certificate Reuse Direct DirPort Connection User Identification Weakness |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-04-20 | Name : The remote Mandriva Linux host is missing a security update. File : mandriva_MDVSA-2013-132.nasl - Type : ACT_GATHER_INFO |
| 2012-01-24 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201201-12.nasl - Type : ACT_GATHER_INFO |
| 2011-11-14 | Name : The remote Fedora host is missing a security update. File : fedora_2011-15208.nasl - Type : ACT_GATHER_INFO |
| 2011-11-07 | Name : The remote Fedora host is missing a security update. File : fedora_2011-15117.nasl - Type : ACT_GATHER_INFO |
| 2011-10-31 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2331.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
| Source | Url |
|---|---|
| CONFIRM | https://blog.torproject.org/blog/tor-02234-released-security-patches |
| DEBIAN | http://www.debian.org/security/2011/dsa-2331 |
Alert History
| Date | Informations |
|---|---|
| 2021-05-05 01:08:34 |
|
| 2021-05-04 12:14:49 |
|
| 2021-04-22 01:16:08 |
|
| 2020-05-23 01:44:56 |
|
| 2020-05-23 00:29:03 |
|
| 2016-04-26 20:54:06 |
|
| 2014-02-17 11:03:43 |
|
| 2013-05-10 23:03:59 |
|
