CVE-2009-0939: Critical severity Tor (The Onion Router) vulnerability
Published Mar 18, 2009
·Updated
Tor before 0.2.0.34 treats incomplete IPv4 addresses as valid, which has unknown impact and attack vectors related to "Spec conformance," as demonstrated using 192.168.0.
Affected Software
30 affected components
Tor (The Onion Router)<=0.2.0.33
Tor (The Onion Router)=0.2.0.1-alpha
Tor (The Onion Router)=0.2.0.2-alpha
Tor (The Onion Router)=0.2.0.3-alpha
Tor (The Onion Router)=0.2.0.4-alpha
Tor (The Onion Router)=0.2.0.5-alpha
Tor (The Onion Router)=0.2.0.6-alpha
Tor (The Onion Router)=0.2.0.10-alpha
Tor (The Onion Router)=0.2.0.11-alpha
Tor (The Onion Router)=0.2.0.12-alpha
Tor (The Onion Router)=0.2.0.13-alpha
Tor (The Onion Router)=0.2.0.14-alpha
Tor (The Onion Router)=0.2.0.15-alpha
Tor (The Onion Router)=0.2.0.16-alpha
Tor (The Onion Router)=0.2.0.17-alpha
Tor (The Onion Router)=0.2.0.18-alpha
Tor (The Onion Router)=0.2.0.19-alpha
Tor (The Onion Router)=0.2.0.20-alpha
Tor (The Onion Router)=0.2.0.21-alpha
Tor (The Onion Router)=0.2.0.22-alpha
Tor (The Onion Router)=0.2.0.23-alpha
Tor (The Onion Router)=0.2.0.24-alpha
Tor (The Onion Router)=0.2.0.25-alpha
Tor (The Onion Router)=0.2.0.26-alpha
Tor (The Onion Router)=0.2.0.27-alpha
Tor (The Onion Router)=0.2.0.28-alpha
Tor (The Onion Router)=0.2.0.29-alpha
Tor (The Onion Router)=0.2.0.30-alpha
Tor (The Onion Router)=0.2.0.31-alpha
Tor (The Onion Router)=0.2.0.32-alpha
Event History
Mar 18, 2009
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Data Sourced
via NVD·02:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2009-0939?
The severity of CVE-2009-0939 is currently unknown due to its impact relating to unspecified attack vectors.
2
How do I fix CVE-2009-0939?
To fix CVE-2009-0939, upgrade to Tor version 0.2.0.34 or later.
3
What versions of Tor are affected by CVE-2009-0939?
CVE-2009-0939 affects all Tor versions prior to 0.2.0.34.
4
What is the main issue with CVE-2009-0939?
The main issue with CVE-2009-0939 is that it treats incomplete IPv4 addresses as valid, leading to potential spec conformance problems.
5
Can CVE-2009-0939 be exploited remotely?
While the specific exploitability of CVE-2009-0939 is unknown, its nature suggests potential for remote exploitation.