<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Dear Roger and every reader of this mailing list,<br>
<br>
I read about the critical security vulnerability in your release notes.
I understand that some funny hackers have accessed tor's control port
9051 and modified the torrc. Is that right?<br>
<br>
To my understanding any Tor client or server behind a well-configured <b>physical
firewall</b> aren't vulnerable to this type of attack.<br>
The only ones vulnerable are people <b>without firewall</b> or with
only a <b>software firewall</b> installed on their computer. People
with a badly configured physical firewall, for example with <b>DMZ</b>
enabled are also at risk.<br>
<br>
A simple trick to avoid this type of attack is to have a <b>physical
firewall</b> between your computer and the internet connection.<br>
A cheaper type of combined router/firewall/switch nowadays only cost
around 30€ or 40$US. It's a simple and effective way to protect
yourself from attacks made possible by opened ports in various programs.<br>
<br>
(Please tell me if I'm wrong. Because if so I want to change my tor
server from version 0.2.0.2alpha immediately. Until then I will keep
that version as there is no version 0.2.0.4alpha yet for win32.)<br>
<br>
/Vikingserver<br>
<br>
<br>
Roger Dingledine skrev:
<blockquote cite="mid:20070802221918.GF20786@moria.seul.org" type="cite">
<pre wrap="">Tor 0.1.2.16 fixes a critical security vulnerability that allows a
remote attacker in certain situations to rewrite the user's torrc
configuration file. This can completely compromise anonymity of users
in most configurations, including those running the Vidalia bundles,
TorK, etc. Or worse.
Users who do not have ControlPort enabled are secure; if you are not
sure, you should upgrade and you should probably overwrite your torrc
file with the default when you upgrade. More details will be posted over
the next few days.
<a class="moz-txt-link-freetext" href="https://tor.eff.org/download.html">https://tor.eff.org/download.html</a>
We have Vidalia bundles for OS X Tiger on the website now. The recommended
workaround for Windows users is either to wait until we have a Vidalia
bundle ready, or do separate installs of the Win32 "expert" package from
<a class="moz-txt-link-freetext" href="https://tor.eff.org/download-windows">https://tor.eff.org/download-windows</a>
and the Windows Vidalia-only package from
<a class="moz-txt-link-freetext" href="http://vidalia-project.net/download.php">http://vidalia-project.net/download.php</a>
Changes in version 0.1.2.16 - 2007-08-01
o Major security fixes:
- Close immediately after missing authentication on control port;
do not allow multiple authentication attempts.
</pre>
</blockquote>
</body>
</html>