Security bug in 0.0.9.x Tor servers
Roger Dingledine
arma at mit.edu
Thu Jun 16 22:15:33 UTC 2005
Hi folks,
The Tor 0.1.0.10 release from a few days ago includes a fix for a bug
that might allow an attacker to read arbitrary memory (maybe even keys)
from an exit server's process space. We haven't heard any reports of
exploits yet, but hey.
So, I recommend that you all upgrade to 0.1.0.10. :)
If you absolutely cannot upgrade yet (for example if you're the Debian Tor
packager and your distribution is too stubborn to upgrade past libevent
1.0b, which has known crash bugs), I've included a patched tarball for
the old 0.0.9 series at:
http://tor.eff.org/dist/tor-0.0.9.10.tar.gz
http://tor.eff.org/dist/tor-0.0.9.10.tar.gz.asc
--Roger
More information about the tor-announce
mailing list