CVE-2005-2643: Medium severity Tor (The Onion Router) vulnerability

Published Aug 21, 2005

Updated

Tor 0.1.0.13 and earlier, and experimental versions 0.1.1.4-alpha and earlier, does not reject certain weak keys when using ephemeral Diffie-Hellman (DH) handshakes, which allows malicious Tor servers to obtain the keys that a client uses for other systems in the circuit.

Affected Software

27 affected components

Tor (The Onion Router)=0.1.1.1_alpha

Tor (The Onion Router)=0.1.0.7

Tor (The Onion Router)=0.0.9.8

Tor (The Onion Router)=0.0.9.2

Tor (The Onion Router)=0.1.0.10

Tor (The Onion Router)=0.0.9

Tor (The Onion Router)=0.1.0.8

Tor (The Onion Router)=0.0.9.5

Tor (The Onion Router)=0.1.0.12

Tor (The Onion Router)=0.0.9.3

Tor (The Onion Router)=0.0.9.9

Tor (The Onion Router)=0.1.1.3_alpha

Tor (The Onion Router)=0.1.0.5

Tor (The Onion Router)=0.1.0.2

Tor (The Onion Router)=0.1.0.1

Tor (The Onion Router)=0.1.0.13

Tor (The Onion Router)=0.1.0.3

Tor (The Onion Router)=0.0.9.4

Tor (The Onion Router)=0.1.1.4_alpha

Tor (The Onion Router)=0.1.0.6

Tor (The Onion Router)=0.1.0.9

Tor (The Onion Router)=0.1.1.2_alpha

Tor (The Onion Router)=0.0.9.1

Tor (The Onion Router)=0.0.9.7

Tor (The Onion Router)=0.1.0.4

Tor (The Onion Router)=0.0.9.6

Tor (The Onion Router)=0.1.0.11

Remediation

Patch Available

http://secunia.com/advisories/16424

Event History

Aug 21, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-2643?

CVE-2005-2643 is considered a moderate severity vulnerability due to its potential for exposing sensitive keys via weak Diffie-Hellman handshakes.

How do I fix CVE-2005-2643?

To remediate CVE-2005-2643, upgrade to a version of Tor that rejects weak keys, such as any version higher than 0.1.0.13 or 0.1.1.4-alpha.

What versions of Tor are affected by CVE-2005-2643?

CVE-2005-2643 affects Tor versions 0.1.0.13 and earlier, as well as experimental versions 0.1.1.4-alpha and earlier.

What type of attack is possible due to CVE-2005-2643?

Malicious Tor servers can exploit CVE-2005-2643 to obtain keys used by clients for other systems in the circuit.

Can CVE-2005-2643 impact my use of Tor for anonymity?

Yes, CVE-2005-2643 can compromise the anonymity and security of users by potentially leaking cryptographic keys.