CVE-2011-0490: Medium severity tor (the onion router) vulnerability
Published Jan 19, 2011
·Updated
Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha makes calls to Libevent within Libevent log handlers, which might allow remote attackers to cause a denial of service (daemon crash) via vectors that trigger certain log messages.
Affected Software
207 affected components
Tor (The Onion Router)<=0.2.1.28
Tor (The Onion Router)=0.0.2
Tor (The Onion Router)=0.0.2_pre13
Tor (The Onion Router)=0.0.2_pre14
Tor (The Onion Router)=0.0.2_pre15
Tor (The Onion Router)=0.0.2_pre16
Tor (The Onion Router)=0.0.2_pre17
Tor (The Onion Router)=0.0.2_pre18
Tor (The Onion Router)=0.0.2_pre19
Tor (The Onion Router)=0.0.2_pre20
Tor (The Onion Router)=0.0.2_pre21
Tor (The Onion Router)=0.0.2_pre22
Tor (The Onion Router)=0.0.2_pre23
Tor (The Onion Router)=0.0.2_pre24
Tor (The Onion Router)=0.0.2_pre25
Tor (The Onion Router)=0.0.2_pre26
Tor (The Onion Router)=0.0.2_pre27
Tor (The Onion Router)=0.0.3
Tor (The Onion Router)=0.0.4
Tor (The Onion Router)=0.0.5
Tor (The Onion Router)=0.0.6
Tor (The Onion Router)=0.0.6.1
Tor (The Onion Router)=0.0.6.2
Tor (The Onion Router)=0.0.7
Tor (The Onion Router)=0.0.7.1
Tor (The Onion Router)=0.0.7.2
Tor (The Onion Router)=0.0.7.3
Tor (The Onion Router)=0.0.8
Tor (The Onion Router)=0.0.8.1
Tor (The Onion Router)=0.0.9
Tor (The Onion Router)=0.0.9.1
Tor (The Onion Router)=0.0.9.2
Tor (The Onion Router)=0.0.9.3
Tor (The Onion Router)=0.0.9.4
Tor (The Onion Router)=0.0.9.5
Tor (The Onion Router)=0.0.9.6
Tor (The Onion Router)=0.0.9.7
Tor (The Onion Router)=0.0.9.8
Tor (The Onion Router)=0.0.9.9
Tor (The Onion Router)=0.0.9.10
Tor (The Onion Router)=0.1.0.1
Tor (The Onion Router)=0.1.0.2
Tor (The Onion Router)=0.1.0.3
Tor (The Onion Router)=0.1.0.4
Tor (The Onion Router)=0.1.0.5
Tor (The Onion Router)=0.1.0.6
Tor (The Onion Router)=0.1.0.7
Tor (The Onion Router)=0.1.0.8
Tor (The Onion Router)=0.1.0.9
Tor (The Onion Router)=0.1.0.10
Tor (The Onion Router)=0.1.0.11
Tor (The Onion Router)=0.1.0.12
Tor (The Onion Router)=0.1.0.13
Tor (The Onion Router)=0.1.0.14
Tor (The Onion Router)=0.1.0.15
Tor (The Onion Router)=0.1.0.16
Tor (The Onion Router)=0.1.0.17
Tor (The Onion Router)=0.1.1
Tor (The Onion Router)=0.1.1.1
Tor (The Onion Router)=0.1.1.1-alpha
Tor (The Onion Router)=0.1.1.2
Tor (The Onion Router)=0.1.1.2-alpha
Tor (The Onion Router)=0.1.1.3
Tor (The Onion Router)=0.1.1.3-alpha
Tor (The Onion Router)=0.1.1.4
Tor (The Onion Router)=0.1.1.4-alpha
Tor (The Onion Router)=0.1.1.5
Tor (The Onion Router)=0.1.1.5-alpha
Tor (The Onion Router)=0.1.1.6
Tor (The Onion Router)=0.1.1.6-alpha
Tor (The Onion Router)=0.1.1.7
Tor (The Onion Router)=0.1.1.7-alpha
Tor (The Onion Router)=0.1.1.8
Tor (The Onion Router)=0.1.1.8-alpha
Tor (The Onion Router)=0.1.1.9
Tor (The Onion Router)=0.1.1.9-alpha
Tor (The Onion Router)=0.1.1.10
Tor (The Onion Router)=0.1.1.10-alpha
Tor (The Onion Router)=0.1.1.11
Tor (The Onion Router)=0.1.1.12
Tor (The Onion Router)=0.1.1.13
Tor (The Onion Router)=0.1.1.14
Tor (The Onion Router)=0.1.1.15
Tor (The Onion Router)=0.1.1.16
Tor (The Onion Router)=0.1.1.17
Tor (The Onion Router)=0.1.1.18
Tor (The Onion Router)=0.1.1.19
Tor (The Onion Router)=0.1.1.20
Tor (The Onion Router)=0.1.1.21
Tor (The Onion Router)=0.1.1.22
Tor (The Onion Router)=0.1.1.23
Tor (The Onion Router)=0.1.1.25
Tor (The Onion Router)=0.1.1.26
Tor (The Onion Router)=0.1.2.1-alpha-cvs
Tor (The Onion Router)=0.1.2.2
Tor (The Onion Router)=0.1.2.3-alpha
Tor (The Onion Router)=0.1.2.4
Tor (The Onion Router)=0.1.2.5
Tor (The Onion Router)=0.1.2.5-alpha
Tor (The Onion Router)=0.1.2.6-alpha
Tor (The Onion Router)=0.1.2.7-alpha
Tor (The Onion Router)=0.1.2.8-beta
Tor (The Onion Router)=0.1.2.9
Tor (The Onion Router)=0.1.2.10
Tor (The Onion Router)=0.1.2.11
Tor (The Onion Router)=0.1.2.12
Tor (The Onion Router)=0.1.2.13
Tor (The Onion Router)=0.1.2.14
Tor (The Onion Router)=0.1.2.15
Tor (The Onion Router)=0.1.2.16
Tor (The Onion Router)=0.1.2.17
Tor (The Onion Router)=0.1.2.18
Tor (The Onion Router)=0.1.2.19
Tor (The Onion Router)=0.1.2.30
Tor (The Onion Router)=0.1.2.31
Tor (The Onion Router)=0.2.0.1-alpha
Tor (The Onion Router)=0.2.0.2-alpha
Tor (The Onion Router)=0.2.0.3-alpha
Tor (The Onion Router)=0.2.0.4-alpha
Tor (The Onion Router)=0.2.0.5-alpha
Tor (The Onion Router)=0.2.0.6-alpha
Tor (The Onion Router)=0.2.0.7-alpha
Tor (The Onion Router)=0.2.0.8-alpha
Tor (The Onion Router)=0.2.0.9-alpha
Tor (The Onion Router)=0.2.0.10-alpha
Tor (The Onion Router)=0.2.0.11-alpha
Tor (The Onion Router)=0.2.0.12-alpha
Tor (The Onion Router)=0.2.0.13-alpha
Tor (The Onion Router)=0.2.0.14-alpha
Tor (The Onion Router)=0.2.0.15-alpha
Tor (The Onion Router)=0.2.0.16-alpha
Tor (The Onion Router)=0.2.0.17-alpha
Tor (The Onion Router)=0.2.0.18-alpha
Tor (The Onion Router)=0.2.0.19-alpha
Tor (The Onion Router)=0.2.0.20-alpha
Tor (The Onion Router)=0.2.0.21-alpha
Tor (The Onion Router)=0.2.0.22-alpha
Tor (The Onion Router)=0.2.0.23-alpha
Tor (The Onion Router)=0.2.0.24-alpha
Tor (The Onion Router)=0.2.0.25-alpha
Tor (The Onion Router)=0.2.0.26-alpha
Tor (The Onion Router)=0.2.0.27-alpha
Tor (The Onion Router)=0.2.0.28-alpha
Tor (The Onion Router)=0.2.0.29
Tor (The Onion Router)=0.2.0.29-alpha
Tor (The Onion Router)=0.2.0.30
Tor (The Onion Router)=0.2.0.30-alpha
Tor (The Onion Router)=0.2.0.31
Tor (The Onion Router)=0.2.0.31-alpha
Tor (The Onion Router)=0.2.0.32-alpha
Tor (The Onion Router)=0.2.0.33
Tor (The Onion Router)=0.2.0.34-alpha
Tor (The Onion Router)=0.2.0.35
Tor (The Onion Router)=0.2.1.1-alpha
Tor (The Onion Router)=0.2.1.2-alpha
Tor (The Onion Router)=0.2.1.3-alpha
Tor (The Onion Router)=0.2.1.4-alpha
Tor (The Onion Router)=0.2.1.5-alpha
Tor (The Onion Router)=0.2.1.6-alpha
Tor (The Onion Router)=0.2.1.7-alpha
Tor (The Onion Router)=0.2.1.8-alpha
Tor (The Onion Router)=0.2.1.9-alpha
Tor (The Onion Router)=0.2.1.10-alpha
Tor (The Onion Router)=0.2.1.11-alpha
Tor (The Onion Router)=0.2.1.12
Tor (The Onion Router)=0.2.1.12-alpha
Tor (The Onion Router)=0.2.1.13
Tor (The Onion Router)=0.2.1.14
Tor (The Onion Router)=0.2.1.15
Tor (The Onion Router)=0.2.1.16
Tor (The Onion Router)=0.2.1.17
Tor (The Onion Router)=0.2.1.18
Tor (The Onion Router)=0.2.1.19
Tor (The Onion Router)=0.2.1.20
Tor (The Onion Router)=0.2.1.21
Tor (The Onion Router)=0.2.1.22
Tor (The Onion Router)=0.2.1.23
Tor (The Onion Router)=0.2.1.24
Tor (The Onion Router)=0.2.1.25
Tor (The Onion Router)=0.2.1.26
Tor (The Onion Router)=0.2.1.27
Tor (The Onion Router)=0.2.2.1
Tor (The Onion Router)=0.2.2.1-alpha
Tor (The Onion Router)=0.2.2.2
Tor (The Onion Router)=0.2.2.2-alpha
Tor (The Onion Router)=0.2.2.3
Tor (The Onion Router)=0.2.2.3-alpha
Tor (The Onion Router)=0.2.2.4
Tor (The Onion Router)=0.2.2.4-alpha
Tor (The Onion Router)=0.2.2.5
Tor (The Onion Router)=0.2.2.5-alpha
Tor (The Onion Router)=0.2.2.6
Tor (The Onion Router)=0.2.2.6-alpha
Tor (The Onion Router)=0.2.2.7-alpha
Tor (The Onion Router)=0.2.2.8-alpha
Tor (The Onion Router)=0.2.2.9-alpha
Tor (The Onion Router)=0.2.2.10-alpha
Tor (The Onion Router)=0.2.2.11-alpha
Tor (The Onion Router)=0.2.2.12-alpha
Tor (The Onion Router)=0.2.2.13-alpha
Tor (The Onion Router)=0.2.2.14-alpha
Tor (The Onion Router)=0.2.2.15-alpha
Tor (The Onion Router)=0.2.2.16-alpha
Tor (The Onion Router)=0.2.2.17-alpha
Tor (The Onion Router)=0.2.2.18-alpha
Tor (The Onion Router)=0.2.2.19-alpha
Tor (The Onion Router)=0.2.2.20-alpha
Remediation
Patch Available
Event History
Jan 19, 2011
CVE Published
via MITRE·11:00 AM
Data Sourced
via MITRE·11:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2011-0490?
CVE-2011-0490 has a moderate severity rating as it can lead to denial of service and daemon crashes.
2
How do I fix CVE-2011-0490?
To fix CVE-2011-0490, upgrade to Tor versions 0.2.1.29 or higher, or 0.2.2.21-alpha or higher.
3
What issue does CVE-2011-0490 describe?
CVE-2011-0490 describes a vulnerability in Tor that allows remote attackers to cause a denial of service via specific log messages.
4
Which versions of Tor are affected by CVE-2011-0490?
CVE-2011-0490 affects Tor versions prior to 0.2.1.29 and all versions of 0.2.2.x before 0.2.2.21-alpha.
5
Can CVE-2011-0490 allow remote exploitation?
Yes, CVE-2011-0490 can be exploited remotely if specific conditions triggering log messages are met.