CVE-2006-3414: Medium severity Tor (The Onion Router) vulnerability

Published Jul 7, 2006

Updated

Tor before 0.1.1.20 supports server descriptors that contain hostnames instead of IP addresses, which allows remote attackers to arbitrarily group users by providing preferential address resolution.

Affected Software

68 affected components

Tor (The Onion Router)=0.1.1.1_alpha

Tor (The Onion Router)=0.0.6.2

Tor (The Onion Router)=0.1.0.18

Tor (The Onion Router)=0.0.2_pre24

Tor (The Onion Router)=0.0.2_pre16

Tor (The Onion Router)=0.0.5

Tor (The Onion Router)=0.1.0.7

Tor (The Onion Router)=0.0.9.8

Tor (The Onion Router)=0.0.9.10

Tor (The Onion Router)=0.0.9.2

Tor (The Onion Router)=0.0.7

Tor (The Onion Router)=0.1.0.10

Tor (The Onion Router)=0.0.9

Tor (The Onion Router)=0.1.0.8

Tor (The Onion Router)=0.0.9.5

Tor (The Onion Router)=0.1.0.12

Tor (The Onion Router)=0.0.9.3

Tor (The Onion Router)=0.0.2_pre17

Tor (The Onion Router)=0.0.8

Tor (The Onion Router)=0.0.9.9

Tor (The Onion Router)=0.1.1.3_alpha

Tor (The Onion Router)=0.1.0.5

Tor (The Onion Router)=0.1.0.2

Tor (The Onion Router)=0.1.0.1

Tor (The Onion Router)=0.0.2_pre19

Tor (The Onion Router)=0.0.2_pre23

Tor (The Onion Router)=0.0.2_pre14

Tor (The Onion Router)=0.1.0.13

Tor (The Onion Router)=0.1.0.19

Tor (The Onion Router)=0.1.0.3

Tor (The Onion Router)=0.0.7.1

Tor (The Onion Router)=0.0.6

Tor (The Onion Router)=0.1.1.10_alpha

Tor (The Onion Router)=0.0.2_pre26

Tor (The Onion Router)=0.1.0.14

Tor (The Onion Router)=0.0.3

Tor (The Onion Router)=0.0.9.4

Tor (The Onion Router)=0.1.1.4_alpha

Tor (The Onion Router)=0.0.2_pre22

Tor (The Onion Router)=0.0.2_pre21

Tor (The Onion Router)=0.1.0.15

Tor (The Onion Router)=0.0.6.1

Tor (The Onion Router)=0.0.2

Tor (The Onion Router)=0.1.0.6

Tor (The Onion Router)=0.1.1.7_alpha

Tor (The Onion Router)=0.0.2_pre13

Tor (The Onion Router)=0.1.1.6_alpha

Tor (The Onion Router)=0.1.0.9

Tor (The Onion Router)=0.0.7.3

Tor (The Onion Router)=0.0.7.2

Tor (The Onion Router)=0.1.1.2_alpha

Tor (The Onion Router)=0.1.0.16

Tor (The Onion Router)=0.0.9.1

Tor (The Onion Router)=0.0.2_pre18

Tor (The Onion Router)=0.0.2_pre27

Tor (The Onion Router)=0.0.9.7

Tor (The Onion Router)=0.1.0.17

Tor (The Onion Router)=0.0.8.1

Tor (The Onion Router)=0.0.4

Tor (The Onion Router)=0.0.2_pre25

Tor (The Onion Router)=0.1.0.4

Tor (The Onion Router)=0.0.9.6

Tor (The Onion Router)=0.1.1.8_alpha

Tor (The Onion Router)=0.1.1.9_alpha

Tor (The Onion Router)=0.1.1.5_alpha

Tor (The Onion Router)=0.1.0.11

Tor (The Onion Router)=0.0.2_pre15

Tor (The Onion Router)=0.0.2_pre20

Remediation

Patch Available

http://secunia.com/advisories/20514

Event History

Jul 7, 2006

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-3414?

CVE-2006-3414 is classified as a moderate severity vulnerability due to its potential to allow grouping of users by preferential address resolution.

How do I fix CVE-2006-3414?

To fix CVE-2006-3414, update your Tor installation to a version greater than 0.1.1.20.

What impact does CVE-2006-3414 have on Tor users?

CVE-2006-3414 can compromise user anonymity by allowing attackers to organize users based on hostname resolution, potentially leading to targeted attacks.

Which versions of Tor are affected by CVE-2006-3414?

CVE-2006-3414 affects multiple versions of Tor including all versions earlier than 0.1.1.20.

Is there a known exploit for CVE-2006-3414?

While there are no widespread public exploits reported for CVE-2006-3414, the vulnerability itself poses a risk to user privacy and anonymity.