CVE-2006-3419: Medium severity tor (the onion router) vulnerability

Published Jul 7, 2006

Updated

Tor before 0.1.1.20 uses OpenSSL pseudo-random bytes (RANDpseudobytes) instead of cryptographically strong RANDbytes, and seeds the entropy value at start-up with 160-bit chunks without reseeding, which makes it easier for attackers to conduct brute force guessing attacks.

Affected Software

68 affected components

Tor (The Onion Router)=0.0.2

Tor (The Onion Router)=0.0.2_pre13

Tor (The Onion Router)=0.0.2_pre14

Tor (The Onion Router)=0.0.2_pre15

Tor (The Onion Router)=0.0.2_pre16

Tor (The Onion Router)=0.0.2_pre17

Tor (The Onion Router)=0.0.2_pre18

Tor (The Onion Router)=0.0.2_pre19

Tor (The Onion Router)=0.0.2_pre20

Tor (The Onion Router)=0.0.2_pre21

Tor (The Onion Router)=0.0.2_pre22

Tor (The Onion Router)=0.0.2_pre23

Tor (The Onion Router)=0.0.2_pre24

Tor (The Onion Router)=0.0.2_pre25

Tor (The Onion Router)=0.0.2_pre26

Tor (The Onion Router)=0.0.2_pre27

Tor (The Onion Router)=0.0.3

Tor (The Onion Router)=0.0.4

Tor (The Onion Router)=0.0.5

Tor (The Onion Router)=0.0.6

Tor (The Onion Router)=0.0.6.1

Tor (The Onion Router)=0.0.6.2

Tor (The Onion Router)=0.0.7

Tor (The Onion Router)=0.0.7.1

Tor (The Onion Router)=0.0.7.2

Tor (The Onion Router)=0.0.7.3

Tor (The Onion Router)=0.0.8

Tor (The Onion Router)=0.0.8.1

Tor (The Onion Router)=0.0.9

Tor (The Onion Router)=0.0.9.1

Tor (The Onion Router)=0.0.9.2

Tor (The Onion Router)=0.0.9.3

Tor (The Onion Router)=0.0.9.4

Tor (The Onion Router)=0.0.9.5

Tor (The Onion Router)=0.0.9.6

Tor (The Onion Router)=0.0.9.7

Tor (The Onion Router)=0.0.9.8

Tor (The Onion Router)=0.0.9.9

Tor (The Onion Router)=0.0.9.10

Tor (The Onion Router)=0.1.0.1

Tor (The Onion Router)=0.1.0.2

Tor (The Onion Router)=0.1.0.3

Tor (The Onion Router)=0.1.0.4

Tor (The Onion Router)=0.1.0.5

Tor (The Onion Router)=0.1.0.6

Tor (The Onion Router)=0.1.0.7

Tor (The Onion Router)=0.1.0.8

Tor (The Onion Router)=0.1.0.9

Tor (The Onion Router)=0.1.0.10

Tor (The Onion Router)=0.1.0.11

Tor (The Onion Router)=0.1.0.12

Tor (The Onion Router)=0.1.0.13

Tor (The Onion Router)=0.1.0.14

Tor (The Onion Router)=0.1.0.15

Tor (The Onion Router)=0.1.0.16

Tor (The Onion Router)=0.1.0.17

Tor (The Onion Router)=0.1.0.18

Tor (The Onion Router)=0.1.0.19

Tor (The Onion Router)=0.1.1.1_alpha

Tor (The Onion Router)=0.1.1.2_alpha

Tor (The Onion Router)=0.1.1.3_alpha

Tor (The Onion Router)=0.1.1.4_alpha

Tor (The Onion Router)=0.1.1.5_alpha

Tor (The Onion Router)=0.1.1.6_alpha

Tor (The Onion Router)=0.1.1.7_alpha

Tor (The Onion Router)=0.1.1.8_alpha

Tor (The Onion Router)=0.1.1.9_alpha

Tor (The Onion Router)=0.1.1.10_alpha

Remediation

Patch Available

http://secunia.com/advisories/20514

Event History

Jul 7, 2006

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-3419?

The severity of CVE-2006-3419 is considered medium, as it allows for potential brute-force guessing attacks against cryptographic keys.

How do I fix CVE-2006-3419?

To fix CVE-2006-3419, upgrade to Tor version 0.1.1.20 or later, which uses cryptographically strong random bytes.

Which versions of Tor are affected by CVE-2006-3419?

CVE-2006-3419 affects all Tor versions prior to 0.1.1.20, including earlier releases and pre-releases.

What vulnerabilities does CVE-2006-3419 exploit?

CVE-2006-3419 exploits the use of weak pseudo-random number generation instead of strong cryptographic random number generation.

Can CVE-2006-3419 impact the confidentiality of Tor users?

Yes, CVE-2006-3419 can compromise the confidentiality of Tor users by allowing attackers to guess cryptographic keys more easily.