CVE-2006-3417: Medium severity tor (the onion router) vulnerability

Published Jul 7, 2006

Updated

Tor client before 0.1.1.20 prefers entry points based on isfast or isstable flags, which could allow remote attackers to be preferred over nodes that are identified as more trustworthy "entry guard" (isguard) systems by directory authorities.

Affected Software

68 affected components

Tor (The Onion Router)=0.1.1.1_alpha

Tor (The Onion Router)=0.0.6.2

Tor (The Onion Router)=0.1.0.18

Tor (The Onion Router)=0.0.2_pre24

Tor (The Onion Router)=0.0.2_pre16

Tor (The Onion Router)=0.0.5

Tor (The Onion Router)=0.1.0.7

Tor (The Onion Router)=0.0.9.8

Tor (The Onion Router)=0.0.9.10

Tor (The Onion Router)=0.0.9.2

Tor (The Onion Router)=0.0.7

Tor (The Onion Router)=0.1.0.10

Tor (The Onion Router)=0.0.9

Tor (The Onion Router)=0.1.0.8

Tor (The Onion Router)=0.0.9.5

Tor (The Onion Router)=0.1.0.12

Tor (The Onion Router)=0.0.9.3

Tor (The Onion Router)=0.0.2_pre17

Tor (The Onion Router)=0.0.8

Tor (The Onion Router)=0.0.9.9

Tor (The Onion Router)=0.1.1.3_alpha

Tor (The Onion Router)=0.1.0.5

Tor (The Onion Router)=0.1.0.2

Tor (The Onion Router)=0.1.0.1

Tor (The Onion Router)=0.0.2_pre19

Tor (The Onion Router)=0.0.2_pre23

Tor (The Onion Router)=0.0.2_pre14

Tor (The Onion Router)=0.1.0.13

Tor (The Onion Router)=0.1.0.19

Tor (The Onion Router)=0.1.0.3

Tor (The Onion Router)=0.0.7.1

Tor (The Onion Router)=0.0.6

Tor (The Onion Router)=0.1.1.10_alpha

Tor (The Onion Router)=0.0.2_pre26

Tor (The Onion Router)=0.1.0.14

Tor (The Onion Router)=0.0.3

Tor (The Onion Router)=0.0.9.4

Tor (The Onion Router)=0.1.1.4_alpha

Tor (The Onion Router)=0.0.2_pre22

Tor (The Onion Router)=0.0.2_pre21

Tor (The Onion Router)=0.1.0.15

Tor (The Onion Router)=0.0.6.1

Tor (The Onion Router)=0.0.2

Tor (The Onion Router)=0.1.0.6

Tor (The Onion Router)=0.1.1.7_alpha

Tor (The Onion Router)=0.0.2_pre13

Tor (The Onion Router)=0.1.1.6_alpha

Tor (The Onion Router)=0.1.0.9

Tor (The Onion Router)=0.0.7.3

Tor (The Onion Router)=0.0.7.2

Tor (The Onion Router)=0.1.1.2_alpha

Tor (The Onion Router)=0.1.0.16

Tor (The Onion Router)=0.0.9.1

Tor (The Onion Router)=0.0.2_pre18

Tor (The Onion Router)=0.0.2_pre27

Tor (The Onion Router)=0.0.9.7

Tor (The Onion Router)=0.1.0.17

Tor (The Onion Router)=0.0.8.1

Tor (The Onion Router)=0.0.4

Tor (The Onion Router)=0.0.2_pre25

Tor (The Onion Router)=0.1.0.4

Tor (The Onion Router)=0.0.9.6

Tor (The Onion Router)=0.1.1.8_alpha

Tor (The Onion Router)=0.1.1.9_alpha

Tor (The Onion Router)=0.1.1.5_alpha

Tor (The Onion Router)=0.1.0.11

Tor (The Onion Router)=0.0.2_pre15

Tor (The Onion Router)=0.0.2_pre20

Remediation

Patch Available

http://secunia.com/advisories/20514

Event History

Jul 7, 2006

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-3417?

CVE-2006-3417 has a low severity rating as it primarily affects the selection of entry guard nodes in the Tor anonymity network.

How do I fix CVE-2006-3417?

To fix CVE-2006-3417, upgrade to the Tor client version 0.1.1.20 or later where the issue has been addressed.

What systems are affected by CVE-2006-3417?

CVE-2006-3417 affects various versions of the Tor client prior to 0.1.1.20.

Is there a workaround for CVE-2006-3417?

There is no specific workaround for CVE-2006-3417; upgrading to a patched version is the recommended solution.

What does CVE-2006-3417 exploit?

CVE-2006-3417 exploits the Tor client's preference for entry points based on stability and speed over trustworthiness.