torproject/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-12-06 19:41:15 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Don't use any OR connection which sent us a CREATE_FAST cell for an EXTEND

Browse Source 
Fix suggested by Nick Mathewson.
This commit is contained in:
Robert Ransom
2011-10-23 14:27:56 -07:00
committed by Sebastian Hahn
parent 638fdedcf1
commit af12c39d6d
4 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
changes/issue-2011-10-19L
+9
View File
@@ -10,3 +10,12 @@
upgrade. Fixes CVE-2011-2768. Bugfix on FIXME; found by
frosty_un.
- Don't use any OR connection on which we have received a
CREATE_FAST cell to satisfy an EXTEND request. Previously, we
would not consider whether a connection appears to be from a
client or bridge when deciding whether to use that connection to
satisfy an EXTEND request. Mitigates CVE-2011-2768, by
preventing an attacker from determining whether an unpatched
client is connected to a patched relay. Bugfix on FIXME; found
by frosty_un.