CVE-2006-3413: Medium severity tor (the onion router) vulnerability

Published Jul 7, 2006

Updated

The privoxy configuration file in Tor before 0.1.1.20, when run on Apple OS X, logs all data via the "logfile", which allows attackers to obtain potentially sensitive information.

Affected Software

68 affected components

Tor (The Onion Router)=0.1.1.1_alpha

Tor (The Onion Router)=0.0.6.2

Tor (The Onion Router)=0.1.0.18

Tor (The Onion Router)=0.0.2_pre24

Tor (The Onion Router)=0.0.2_pre16

Tor (The Onion Router)=0.0.5

Tor (The Onion Router)=0.1.0.7

Tor (The Onion Router)=0.0.9.8

Tor (The Onion Router)=0.0.9.10

Tor (The Onion Router)=0.0.9.2

Tor (The Onion Router)=0.0.7

Tor (The Onion Router)=0.1.0.10

Tor (The Onion Router)=0.0.9

Tor (The Onion Router)=0.1.0.8

Tor (The Onion Router)=0.0.9.5

Tor (The Onion Router)=0.1.0.12

Tor (The Onion Router)=0.0.9.3

Tor (The Onion Router)=0.0.2_pre17

Tor (The Onion Router)=0.0.8

Tor (The Onion Router)=0.0.9.9

Tor (The Onion Router)=0.1.1.3_alpha

Tor (The Onion Router)=0.1.0.5

Tor (The Onion Router)=0.1.0.2

Tor (The Onion Router)=0.1.0.1

Tor (The Onion Router)=0.0.2_pre19

Tor (The Onion Router)=0.0.2_pre23

Tor (The Onion Router)=0.0.2_pre14

Tor (The Onion Router)=0.1.0.13

Tor (The Onion Router)=0.1.0.19

Tor (The Onion Router)=0.1.0.3

Tor (The Onion Router)=0.0.7.1

Tor (The Onion Router)=0.0.6

Tor (The Onion Router)=0.1.1.10_alpha

Tor (The Onion Router)=0.0.2_pre26

Tor (The Onion Router)=0.1.0.14

Tor (The Onion Router)=0.0.3

Tor (The Onion Router)=0.0.9.4

Tor (The Onion Router)=0.1.1.4_alpha

Tor (The Onion Router)=0.0.2_pre22

Tor (The Onion Router)=0.0.2_pre21

Tor (The Onion Router)=0.1.0.15

Tor (The Onion Router)=0.0.6.1

Tor (The Onion Router)=0.0.2

Tor (The Onion Router)=0.1.0.6

Tor (The Onion Router)=0.1.1.7_alpha

Tor (The Onion Router)=0.0.2_pre13

Tor (The Onion Router)=0.1.1.6_alpha

Tor (The Onion Router)=0.1.0.9

Tor (The Onion Router)=0.0.7.3

Tor (The Onion Router)=0.0.7.2

Tor (The Onion Router)=0.1.1.2_alpha

Tor (The Onion Router)=0.1.0.16

Tor (The Onion Router)=0.0.9.1

Tor (The Onion Router)=0.0.2_pre18

Tor (The Onion Router)=0.0.2_pre27

Tor (The Onion Router)=0.0.9.7

Tor (The Onion Router)=0.1.0.17

Tor (The Onion Router)=0.0.8.1

Tor (The Onion Router)=0.0.4

Tor (The Onion Router)=0.0.2_pre25

Tor (The Onion Router)=0.1.0.4

Tor (The Onion Router)=0.0.9.6

Tor (The Onion Router)=0.1.1.8_alpha

Tor (The Onion Router)=0.1.1.9_alpha

Tor (The Onion Router)=0.1.1.5_alpha

Tor (The Onion Router)=0.1.0.11

Tor (The Onion Router)=0.0.2_pre15

Tor (The Onion Router)=0.0.2_pre20

Remediation

Patch Available

http://secunia.com/advisories/20514

Event History

Jul 7, 2006

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-3413?

CVE-2006-3413 has a high severity rating due to its potential to expose sensitive information through logging.

How do I fix CVE-2006-3413?

To fix CVE-2006-3413, upgrade to a version of Tor that addresses this vulnerability, specifically versions 0.1.1.20 or later.

Which versions of Tor are affected by CVE-2006-3413?

CVE-2006-3413 affects several Tor versions including 0.1.1.1_alpha, 0.0.6.2, and earlier versions.

What is the impact of CVE-2006-3413?

The impact of CVE-2006-3413 allows attackers to gain access to potentially sensitive information logged by the privoxy configuration.

Can CVE-2006-3413 be exploited remotely?

Yes, CVE-2006-3413 can be exploited remotely by attackers leveraging the logging mechanism to access sensitive data.