CVE-2006-3416: Medium severity tor (the onion router) vulnerability

Published Jul 7, 2006

Updated

DISPUTED Tor before 0.1.1.20 kills the circuit when it receives an unrecognized relay command, which causes network circuits to be disbanded. NOTE: while this item is listed under the "Security fixes" section of the developer changelog, the developer clarified on 20060707 that this is only a self-DoS. Therefore this issue should not be included in CVE.

Affected Software

68 affected components

Tor (The Onion Router)=0.1.1.1_alpha

Tor (The Onion Router)=0.0.6.2

Tor (The Onion Router)=0.1.0.18

Tor (The Onion Router)=0.0.2_pre24

Tor (The Onion Router)=0.0.2_pre16

Tor (The Onion Router)=0.0.5

Tor (The Onion Router)=0.1.0.7

Tor (The Onion Router)=0.0.9.8

Tor (The Onion Router)=0.0.9.10

Tor (The Onion Router)=0.0.9.2

Tor (The Onion Router)=0.0.7

Tor (The Onion Router)=0.1.0.10

Tor (The Onion Router)=0.0.9

Tor (The Onion Router)=0.1.0.8

Tor (The Onion Router)=0.0.9.5

Tor (The Onion Router)=0.1.0.12

Tor (The Onion Router)=0.0.9.3

Tor (The Onion Router)=0.0.2_pre17

Tor (The Onion Router)=0.0.8

Tor (The Onion Router)=0.0.9.9

Tor (The Onion Router)=0.1.1.3_alpha

Tor (The Onion Router)=0.1.0.5

Tor (The Onion Router)=0.1.0.2

Tor (The Onion Router)=0.1.0.1

Tor (The Onion Router)=0.0.2_pre19

Tor (The Onion Router)=0.0.2_pre23

Tor (The Onion Router)=0.0.2_pre14

Tor (The Onion Router)=0.1.0.13

Tor (The Onion Router)=0.1.0.19

Tor (The Onion Router)=0.1.0.3

Tor (The Onion Router)=0.0.7.1

Tor (The Onion Router)=0.0.6

Tor (The Onion Router)=0.1.1.10_alpha

Tor (The Onion Router)=0.0.2_pre26

Tor (The Onion Router)=0.1.0.14

Tor (The Onion Router)=0.0.3

Tor (The Onion Router)=0.0.9.4

Tor (The Onion Router)=0.1.1.4_alpha

Tor (The Onion Router)=0.0.2_pre22

Tor (The Onion Router)=0.0.2_pre21

Tor (The Onion Router)=0.1.0.15

Tor (The Onion Router)=0.0.6.1

Tor (The Onion Router)=0.0.2

Tor (The Onion Router)=0.1.0.6

Tor (The Onion Router)=0.1.1.7_alpha

Tor (The Onion Router)=0.0.2_pre13

Tor (The Onion Router)=0.1.1.6_alpha

Tor (The Onion Router)=0.1.0.9

Tor (The Onion Router)=0.0.7.3

Tor (The Onion Router)=0.0.7.2

Tor (The Onion Router)=0.1.1.2_alpha

Tor (The Onion Router)=0.1.0.16

Tor (The Onion Router)=0.0.9.1

Tor (The Onion Router)=0.0.2_pre18

Tor (The Onion Router)=0.0.2_pre27

Tor (The Onion Router)=0.0.9.7

Tor (The Onion Router)=0.1.0.17

Tor (The Onion Router)=0.0.8.1

Tor (The Onion Router)=0.0.4

Tor (The Onion Router)=0.0.2_pre25

Tor (The Onion Router)=0.1.0.4

Tor (The Onion Router)=0.0.9.6

Tor (The Onion Router)=0.1.1.8_alpha

Tor (The Onion Router)=0.1.1.9_alpha

Tor (The Onion Router)=0.1.1.5_alpha

Tor (The Onion Router)=0.1.0.11

Tor (The Onion Router)=0.0.2_pre15

Tor (The Onion Router)=0.0.2_pre20

Remediation

Patch Available

http://secunia.com/advisories/20514

Event History

Jul 7, 2006

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Disputed

12:05 AM

Frequently Asked Questions

What is the severity of CVE-2006-3416?

The severity of CVE-2006-3416 is generally considered low as it involves circuit disbandment due to unrecognized relay commands without a critical breach.

How do I fix CVE-2006-3416?

To fix CVE-2006-3416, update Tor to a version equal to or higher than 0.1.1.20.

Which versions of Tor are affected by CVE-2006-3416?

Tor versions prior to 0.1.1.20, including 0.1.1.1_alpha and 0.0.6.2, are affected by CVE-2006-3416.

What can happen if I am using an affected version of Tor with CVE-2006-3416?

Using an affected version of Tor can result in instability of network circuits, leading to disconnection issues.

Is there any known exploit for CVE-2006-3416?

Currently, there are no known exploits specifically targeting CVE-2006-3416, but it is advisable to update to mitigate any potential risks.