CVE-2014-5117: Medium severity tor project tor vulnerability
Published Jul 30, 2014
·Updated
Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a circuit after an inbound RELAYEARLY cell is received by a client, which makes it easier for remote attackers to conduct traffic-confirmation attacks by using the pattern of RELAY and RELAYEARLY cells as a means of communicating information about hidden service names.
Affected Software
124 affected components
torproject Tor<=0.2.4.22
torproject Tor=0.0.2
torproject Tor=0.0.2-pre13
torproject Tor=0.0.2-pre14
torproject Tor=0.0.2-pre15
torproject Tor=0.0.2-pre16
torproject Tor=0.0.2-pre17
torproject Tor=0.0.2-pre18
torproject Tor=0.0.2-pre19
torproject Tor=0.0.2-pre20
torproject Tor=0.0.2-pre21
torproject Tor=0.0.2-pre22
torproject Tor=0.0.2-pre23
torproject Tor=0.0.2-pre24
torproject Tor=0.0.2-pre25
torproject Tor=0.0.2-pre26
torproject Tor=0.0.2-pre27
torproject Tor=0.0.3
torproject Tor=0.0.4
torproject Tor=0.0.5
torproject Tor=0.0.6
torproject Tor=0.0.6.1
torproject Tor=0.0.6.2
torproject Tor=0.0.7
torproject Tor=0.0.7.1
torproject Tor=0.0.7.2
torproject Tor=0.0.7.3
torproject Tor=0.0.8.1
torproject Tor=0.0.9.1
torproject Tor=0.0.9.2
torproject Tor=0.0.9.3
torproject Tor=0.0.9.4
torproject Tor=0.0.9.5
torproject Tor=0.0.9.6
torproject Tor=0.0.9.7
torproject Tor=0.0.9.8
torproject Tor=0.0.9.9
torproject Tor=0.0.9.10
torproject Tor=0.1.0.10
torproject Tor=0.1.0.11
torproject Tor=0.1.0.12
torproject Tor=0.1.0.13
torproject Tor=0.1.0.14
torproject Tor=0.1.0.15
torproject Tor=0.1.0.16
torproject Tor=0.1.0.17
torproject Tor=0.1.1.20
torproject Tor=0.1.1.21
torproject Tor=0.1.1.22
torproject Tor=0.1.1.23
torproject Tor=0.1.1.24
torproject Tor=0.1.1.25
torproject Tor=0.1.1.26
torproject Tor=0.1.2.13
torproject Tor=0.1.2.14
torproject Tor=0.1.2.15
torproject Tor=0.1.2.16
torproject Tor=0.1.2.17
torproject Tor=0.1.2.18
torproject Tor=0.1.2.19
torproject Tor=0.2.0.30
torproject Tor=0.2.0.31
torproject Tor=0.2.0.32
torproject Tor=0.2.0.33
torproject Tor=0.2.0.34
torproject Tor=0.2.0.35
torproject Tor=0.2.2.18
torproject Tor=0.2.2.19
torproject Tor=0.2.2.20
torproject Tor=0.2.2.21
torproject Tor=0.2.2.22
torproject Tor=0.2.2.23
torproject Tor=0.2.2.24
torproject Tor=0.2.2.25
torproject Tor=0.2.2.26
torproject Tor=0.2.2.27
torproject Tor=0.2.2.28
torproject Tor=0.2.2.29
torproject Tor=0.2.2.30
torproject Tor=0.2.2.31
torproject Tor=0.2.2.32
torproject Tor=0.2.2.33
torproject Tor=0.2.2.34
torproject Tor=0.2.2.35
torproject Tor=0.2.2.36
torproject Tor=0.2.2.37
torproject Tor=0.2.2.38
torproject Tor=0.2.3
torproject Tor=0.2.3.13-alpha
torproject Tor=0.2.3.14-alpha
torproject Tor=0.2.3.15-alpha
torproject Tor=0.2.3.16-alpha
torproject Tor=0.2.3.17-beta
torproject Tor=0.2.3.18-rc
torproject Tor=0.2.3.19-rc
torproject Tor=0.2.3.20-rc
torproject Tor=0.2.3.21-rc
torproject Tor=0.2.3.22-rc
torproject Tor=0.2.3.23-rc
torproject Tor=0.2.3.24-rc
torproject Tor=0.2.4.1-alpha
torproject Tor=0.2.4.2-alpha
torproject Tor=0.2.4.3-alpha
torproject Tor=0.2.4.4-alpha
torproject Tor=0.2.4.5-alpha
torproject Tor=0.2.4.6-alpha
torproject Tor=0.2.4.7-alpha
torproject Tor=0.2.4.8-alpha
torproject Tor=0.2.4.9-alpha
torproject Tor=0.2.4.10-alpha
torproject Tor=0.2.4.11-alpha
torproject Tor=0.2.4.12-alpha
torproject Tor=0.2.4.13-alpha
torproject Tor=0.2.4.14-alpha
torproject Tor=0.2.4.15-rc
torproject Tor=0.2.4.16-rc
torproject Tor=0.2.4.17-rc
torproject Tor=0.2.4.18-rc
torproject Tor=0.2.4.19
torproject Tor=0.2.4.20
torproject Tor=0.2.5.2-alpha
torproject Tor=0.2.5.3-alpha
torproject Tor=0.2.5.4-alpha
torproject Tor=0.2.5.5-alpha
Event History
Jul 30, 2014
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-5117?
CVE-2014-5117 has a medium severity rating due to its potential to facilitate traffic-confirmation attacks.
2
How do I fix CVE-2014-5117?
To fix CVE-2014-5117, upgrade to Tor versions 0.2.5.6-alpha or 0.2.4.23 or later.
3
What types of systems are affected by CVE-2014-5117?
CVE-2014-5117 affects various versions of the Tor software prior to updates that address the vulnerability.
4
What is CVE-2014-5117 related to?
CVE-2014-5117 is related to the improper handling of RELAY_EARLY cells, which can aid in traffic analysis.
5
Is there a workaround for CVE-2014-5117?
There are no known workarounds for CVE-2014-5117 other than updating to the fixed versions.