TOR » TOR » 0.0.2_pre16 : Security Vulnerabilities, CVEs, (Information Leak)
routerlist.c in Tor before 0.2.2.38 uses a different amount of time for relay-list iteration depending on which relay is chosen, which might allow remote attackers to obtain sensitive information about relay selection via a timing side-channel attack.
Max CVSS
5.0
EPSS Score
0.64%
Published
2012-08-26
Updated
2013-08-22
Tor before 0.2.2.34, when configured as a bridge, sets up circuits through a process different from the process used by a client, which makes it easier for remote attackers to enumerate bridges by observing circuit building.
Max CVSS
4.3
EPSS Score
0.18%
Published
2011-12-23
Updated
2011-12-23
Tor before 0.2.2.34, when configured as a bridge, uses direct DirPort access instead of a Tor TLS connection for a directory fetch, which makes it easier for remote attackers to enumerate bridges by observing DirPort connections.
Max CVSS
4.3
EPSS Score
0.18%
Published
2011-12-23
Updated
2011-12-23
Tor before 0.2.2.34, when configured as a bridge, accepts the CREATE and CREATE_FAST values in the Command field of a cell within an OR connection that it initiated, which allows remote relays to enumerate bridges by using these values.
Max CVSS
4.3
EPSS Score
0.19%
Published
2011-12-23
Updated
2012-01-19
Tor before 0.2.1.22, and 0.2.2.x before 0.2.2.7-alpha, when functioning as a bridge directory authority, allows remote attackers to obtain sensitive information about bridge identities and bridge descriptors via a dbg-stability.txt directory query.
Max CVSS
5.0
EPSS Score
0.27%
Published
2010-01-25
Updated
2010-01-26
Tor before 0.2.1.22, and 0.2.2.x before 0.2.2.7-alpha, uses deprecated identity keys for certain directory authorities, which makes it easier for man-in-the-middle attackers to compromise the anonymity of traffic sources and destinations.
Max CVSS
5.0
EPSS Score
0.24%
Published
2010-01-25
Updated
2010-02-05
6 vulnerabilities found