CVE-2008-5398: Critical severity tor (the onion router) vulnerability
Published Dec 9, 2008
·Updated
Tor before 0.2.0.32 does not properly process the ClientDNSRejectInternalAddresses configuration option in situations where an exit relay issues a policy-based refusal of a stream, which allows remote exit relays to have an unknown impact by mapping an internal IP address to the destination hostname of a refused stream.
Affected Software
100 affected components
Tor (The Onion Router)<=0.1.2.31
Tor (The Onion Router)=0.0.2
Tor (The Onion Router)=0.0.2_pre13
Tor (The Onion Router)=0.0.2_pre14
Tor (The Onion Router)=0.0.2_pre15
Tor (The Onion Router)=0.0.2_pre16
Tor (The Onion Router)=0.0.2_pre17
Tor (The Onion Router)=0.0.2_pre18
Tor (The Onion Router)=0.0.2_pre19
Tor (The Onion Router)=0.0.2_pre20
Tor (The Onion Router)=0.0.2_pre21
Tor (The Onion Router)=0.0.2_pre22
Tor (The Onion Router)=0.0.2_pre23
Tor (The Onion Router)=0.0.2_pre24
Tor (The Onion Router)=0.0.2_pre25
Tor (The Onion Router)=0.0.2_pre26
Tor (The Onion Router)=0.0.2_pre27
Tor (The Onion Router)=0.0.3
Tor (The Onion Router)=0.0.4
Tor (The Onion Router)=0.0.5
Tor (The Onion Router)=0.0.6
Tor (The Onion Router)=0.0.6.1
Tor (The Onion Router)=0.0.6.2
Tor (The Onion Router)=0.0.7
Tor (The Onion Router)=0.0.7.1
Tor (The Onion Router)=0.0.7.2
Tor (The Onion Router)=0.0.7.3
Tor (The Onion Router)=0.0.8
Tor (The Onion Router)=0.0.8.1
Tor (The Onion Router)=0.0.9
Tor (The Onion Router)=0.0.9.1
Tor (The Onion Router)=0.0.9.2
Tor (The Onion Router)=0.0.9.3
Tor (The Onion Router)=0.0.9.4
Tor (The Onion Router)=0.0.9.5
Tor (The Onion Router)=0.0.9.6
Tor (The Onion Router)=0.0.9.7
Tor (The Onion Router)=0.0.9.8
Tor (The Onion Router)=0.0.9.9
Tor (The Onion Router)=0.0.9.10
Tor (The Onion Router)=0.1.0.1
Tor (The Onion Router)=0.1.0.2
Tor (The Onion Router)=0.1.0.3
Tor (The Onion Router)=0.1.0.4
Tor (The Onion Router)=0.1.0.5
Tor (The Onion Router)=0.1.0.6
Tor (The Onion Router)=0.1.0.7
Tor (The Onion Router)=0.1.0.8
Tor (The Onion Router)=0.1.0.9
Tor (The Onion Router)=0.1.0.10
Tor (The Onion Router)=0.1.0.11
Tor (The Onion Router)=0.1.0.12
Tor (The Onion Router)=0.1.0.13
Tor (The Onion Router)=0.1.0.14
Tor (The Onion Router)=0.1.0.15
Tor (The Onion Router)=0.1.0.16
Tor (The Onion Router)=0.1.0.17
Tor (The Onion Router)=0.1.0.18
Tor (The Onion Router)=0.1.0.19
Tor (The Onion Router)=0.1.1.1
Tor (The Onion Router)=0.1.1.1_alpha
Tor (The Onion Router)=0.1.1.2
Tor (The Onion Router)=0.1.1.2_alpha
Tor (The Onion Router)=0.1.1.3
Tor (The Onion Router)=0.1.1.3_alpha
Tor (The Onion Router)=0.1.1.4
Tor (The Onion Router)=0.1.1.4_alpha
Tor (The Onion Router)=0.1.1.5
Tor (The Onion Router)=0.1.1.5_alpha
Tor (The Onion Router)=0.1.1.6
Tor (The Onion Router)=0.1.1.6_alpha
Tor (The Onion Router)=0.1.1.7
Tor (The Onion Router)=0.1.1.7_alpha
Tor (The Onion Router)=0.1.1.8
Tor (The Onion Router)=0.1.1.8_alpha
Tor (The Onion Router)=0.1.1.9
Tor (The Onion Router)=0.1.1.9_alpha
Tor (The Onion Router)=0.1.1.10
Tor (The Onion Router)=0.1.1.10_alpha
Tor (The Onion Router)=0.1.1.11
Tor (The Onion Router)=0.1.1.12
Tor (The Onion Router)=0.1.1.13
Tor (The Onion Router)=0.1.1.14
Tor (The Onion Router)=0.1.1.15
Tor (The Onion Router)=0.1.1.16
Tor (The Onion Router)=0.1.1.17
Tor (The Onion Router)=0.1.1.18
Tor (The Onion Router)=0.1.1.19
Tor (The Onion Router)=0.1.1.20
Tor (The Onion Router)=0.1.1.21
Tor (The Onion Router)=0.1.1.22
Tor (The Onion Router)=0.1.1.23
Tor (The Onion Router)=0.1.1.26
Tor (The Onion Router)=0.1.2.1_alpha-cvs
Tor (The Onion Router)=0.1.2.14
Tor (The Onion Router)=0.1.2.15
Tor (The Onion Router)=0.1.2.17
Tor (The Onion Router)=0.1.2.18
Tor (The Onion Router)=0.1.2.19
Tor (The Onion Router)=0.1.2.30
Remediation
Patch Available
Patch Available
Event History
Dec 9, 2008
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-5398?
CVE-2008-5398 is classified as high severity due to its potential impact on user privacy and network security.
2
How do I fix CVE-2008-5398?
To fix CVE-2008-5398, upgrade to Tor version 0.2.0.32 or later, which addresses this vulnerability.
3
What versions of Tor are affected by CVE-2008-5398?
CVE-2008-5398 affects all Tor versions prior to 0.2.0.32.
4
What are the potential risks associated with CVE-2008-5398?
The risks include remote exit relays potentially mapping internal IP addresses to destination hostnames, compromising user anonymity.
5
Is there a workaround for CVE-2008-5398?
A temporary workaround for CVE-2008-5398 is to avoid using exit relays in sensitive operations until the software is updated.