CVE-2006-3411: Medium severity tor (the onion router) vulnerability

Published Jul 7, 2006

Updated

TLS handshakes in Tor before 0.1.1.20 generate public-private keys based on TLS context rather than the connection, which makes it easier for remote attackers to conduct brute force attacks on the encryption keys.

Affected Software

68 affected components

Tor (The Onion Router)=0.0.2

Tor (The Onion Router)=0.0.2_pre13

Tor (The Onion Router)=0.0.2_pre14

Tor (The Onion Router)=0.0.2_pre15

Tor (The Onion Router)=0.0.2_pre16

Tor (The Onion Router)=0.0.2_pre17

Tor (The Onion Router)=0.0.2_pre18

Tor (The Onion Router)=0.0.2_pre19

Tor (The Onion Router)=0.0.2_pre20

Tor (The Onion Router)=0.0.2_pre21

Tor (The Onion Router)=0.0.2_pre22

Tor (The Onion Router)=0.0.2_pre23

Tor (The Onion Router)=0.0.2_pre24

Tor (The Onion Router)=0.0.2_pre25

Tor (The Onion Router)=0.0.2_pre26

Tor (The Onion Router)=0.0.2_pre27

Tor (The Onion Router)=0.0.3

Tor (The Onion Router)=0.0.4

Tor (The Onion Router)=0.0.5

Tor (The Onion Router)=0.0.6

Tor (The Onion Router)=0.0.6.1

Tor (The Onion Router)=0.0.6.2

Tor (The Onion Router)=0.0.7

Tor (The Onion Router)=0.0.7.1

Tor (The Onion Router)=0.0.7.2

Tor (The Onion Router)=0.0.7.3

Tor (The Onion Router)=0.0.8

Tor (The Onion Router)=0.0.8.1

Tor (The Onion Router)=0.0.9

Tor (The Onion Router)=0.0.9.1

Tor (The Onion Router)=0.0.9.2

Tor (The Onion Router)=0.0.9.3

Tor (The Onion Router)=0.0.9.4

Tor (The Onion Router)=0.0.9.5

Tor (The Onion Router)=0.0.9.6

Tor (The Onion Router)=0.0.9.7

Tor (The Onion Router)=0.0.9.8

Tor (The Onion Router)=0.0.9.9

Tor (The Onion Router)=0.0.9.10

Tor (The Onion Router)=0.1.0.1

Tor (The Onion Router)=0.1.0.2

Tor (The Onion Router)=0.1.0.3

Tor (The Onion Router)=0.1.0.4

Tor (The Onion Router)=0.1.0.5

Tor (The Onion Router)=0.1.0.6

Tor (The Onion Router)=0.1.0.7

Tor (The Onion Router)=0.1.0.8

Tor (The Onion Router)=0.1.0.9

Tor (The Onion Router)=0.1.0.10

Tor (The Onion Router)=0.1.0.11

Tor (The Onion Router)=0.1.0.12

Tor (The Onion Router)=0.1.0.13

Tor (The Onion Router)=0.1.0.14

Tor (The Onion Router)=0.1.0.15

Tor (The Onion Router)=0.1.0.16

Tor (The Onion Router)=0.1.0.17

Tor (The Onion Router)=0.1.0.18

Tor (The Onion Router)=0.1.0.19

Tor (The Onion Router)=0.1.1.1_alpha

Tor (The Onion Router)=0.1.1.2_alpha

Tor (The Onion Router)=0.1.1.3_alpha

Tor (The Onion Router)=0.1.1.4_alpha

Tor (The Onion Router)=0.1.1.5_alpha

Tor (The Onion Router)=0.1.1.6_alpha

Tor (The Onion Router)=0.1.1.7_alpha

Tor (The Onion Router)=0.1.1.8_alpha

Tor (The Onion Router)=0.1.1.9_alpha

Tor (The Onion Router)=0.1.1.10_alpha

Remediation

Patch Available

http://secunia.com/advisories/20514

Event History

Jul 7, 2006

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-3411?

CVE-2006-3411 is considered a medium severity vulnerability due to its potential for facilitating brute force attacks on private keys.

How do I fix CVE-2006-3411?

To fix CVE-2006-3411, upgrade to Tor version 0.1.1.20 or later, which addresses the key generation issue.

Which versions of Tor are affected by CVE-2006-3411?

CVE-2006-3411 affects all versions of Tor prior to 0.1.1.20, including various pre-release versions.

What kind of attack can exploit CVE-2006-3411?

CVE-2006-3411 can be exploited by remote attackers through brute force attacks aimed at the generated encryption keys.

Is CVE-2006-3411 a client-side or server-side vulnerability?

CVE-2006-3411 is considered a server-side vulnerability as it affects the key generation process used by Tor.