December 2011 - tor-commits - lists.torproject.org

[tor/release-0.2.2] Merge remote-tracking branch 'origin/maint-0.2.1' into maint-0.2.2
by nickm＠torproject.org 16 Dec '11

16 Dec '11

commit 562c974ee7913b09bc1b19e4674dea618f2c6328 Merge: 0582746 9d07778 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 15 11:28:44 2011 -0500 Merge remote-tracking branch 'origin/maint-0.2.1' into maint-0.2.2 changes/buffer_bug | 7 +++++++ src/or/buffers.c | 5 +++-- 2 files changed, 10 insertions(+), 2 deletions(-)

1 0

[tor/release-0.2.2] Changelog for 0.2.2.35
by nickm＠torproject.org 16 Dec '11

16 Dec '11

commit d4b935e77f6675fab4e4efe91736a5f63c24e66b Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 15 11:56:26 2011 -0500 Changelog for 0.2.2.35 --- ChangeLog | 24 ++++++++++++++++++++++-- changes/buffer_bug | 7 ------- 2 files changed, 22 insertions(+), 9 deletions(-) diff --git a/ChangeLog b/ChangeLog index a8f677b..e1bc545 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,23 @@ -Changes in version 0.2.2.35 - 2011-12-1? - - Tor 0.2.2.35 fixes several bugs in previous versions, including +Changes in version 0.2.2.35 - 2011-12-16 + Tor 0.2.2.35 fixes a critical heap-overflow security issue in Tor's + buffers code. Absolutely everybody should upgrade. + + The bug relied on an incorrect calculation when making data continuous + in one of our IO buffers, if the first chunk of the buffer was + misaligned by just the wrong amount. The miscalculation would allow an + attacker to overflow a piece of heap-allocated memory. To mount this + attack, the attacker would need to either open a SOCKS connection to + Tor's SocksPort (usually restricted to localhost), or target a Tor + instance configured to make its connections through a SOCKS proxy + (which Tor does not do by default). + + Good security practice requires that all heap-overflow bugs should be + presumed to be exploitable until proven otherwise, so we are treating + this as a potential code execution attack. Please upgrade immediately! + This bug does not affect bufferevents-based builds of Tor. Special + thanks to "Vektor" for reporting this issue to us! + + Tor 0.2.2.35 also fixes several bugs in previous versions, including crash bugs for unusual configurations, and a long-term bug that would that would prevent Tor from starting on Windows machines with draconian AV software. @@ -11,6 +28,9 @@ Changes in version 0.2.2.35 - 2011-12-1? 0.2.2.x series. If you're using a Linux or BSD and its packages are obsolete, stop using those packages and upgrade anyway. + The Tor 0.2.1.x series is also approaching its end-of-life: it will no + longer receive support after some time in early 2011. + o Major bugfixes: - Initialize Libevent with the EVENT_BASE_FLAG_NOLOCK flag enabled, so that it doesn't attempt to allocate a socketpair. This could cause diff --git a/changes/buffer_bug b/changes/buffer_bug deleted file mode 100644 index 634f609..0000000 --- a/changes/buffer_bug +++ /dev/null @@ -1,7 +0,0 @@ - - o Major bugfixes: - - Fix a heap overflow bug that could occur when trying to pull - data into the first chunk of a buffer, when that chunk had - already had some data drained from it. Fixes CVE-2011-2778; - bugfix on 0.2.0.16-alpha. Reported by "Vektor". -

1 0

[tor/release-0.2.2] Increment release to 0.2.2.35
by nickm＠torproject.org 16 Dec '11

16 Dec '11

commit 7264e0d880d35a30e539b58b1c3d3745342b59ed Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 15 12:02:38 2011 -0500 Increment release to 0.2.2.35 --- configure.in | 2 +- contrib/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/configure.in b/configure.in index 12a11a4..c427a5c 100644 --- a/configure.in +++ b/configure.in @@ -4,7 +4,7 @@ dnl Copyright (c) 2007-2008, The Tor Project, Inc. dnl See LICENSE for licensing information AC_INIT -AM_INIT_AUTOMAKE(tor, 0.2.2.34) +AM_INIT_AUTOMAKE(tor, 0.2.2.35) AM_CONFIG_HEADER(orconfig.h) AC_CANONICAL_HOST diff --git a/contrib/tor-mingw.nsi.in b/contrib/tor-mingw.nsi.in index 31ed8c4..fe39f30 100644 --- a/contrib/tor-mingw.nsi.in +++ b/contrib/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.2.2.34" +!define VERSION "0.2.2.35" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index f9c0366..3acaf60 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -233,5 +233,5 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.2.2.34" +#define VERSION "0.2.2.35"

1 0

[tor/release-0.2.2] Copy 0.2.2.35 changelog into releasenotes; fix a date
by nickm＠torproject.org 16 Dec '11

16 Dec '11

commit b04388f9e7546a9f0c77f0d72e41fefb4106d2b5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 15 13:16:30 2011 -0500 Copy 0.2.2.35 changelog into releasenotes; fix a date --- ChangeLog | 2 +- ReleaseNotes | 120 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 121 insertions(+), 1 deletions(-) diff --git a/ChangeLog b/ChangeLog index 98fb411..8d17a50 100644 --- a/ChangeLog +++ b/ChangeLog @@ -29,7 +29,7 @@ Changes in version 0.2.2.35 - 2011-12-16 obsolete, stop using those packages and upgrade anyway. The Tor 0.2.1.x series is also approaching its end-of-life: it will no - longer receive support after some time in early 2011. + longer receive support after some time in early 2012. o Major bugfixes: - Fix a heap overflow bug that could occur when trying to pull diff --git a/ReleaseNotes b/ReleaseNotes index 5ed2539..919491f 100644 --- a/ReleaseNotes +++ b/ReleaseNotes @@ -3,6 +3,126 @@ This document summarizes new features and bugfixes in each stable release of Tor. If you want to see more detailed descriptions of the changes in each development snapshot, see the ChangeLog file. +Changes in version 0.2.2.35 - 2011-12-16 + Tor 0.2.2.35 fixes a critical heap-overflow security issue in Tor's + buffers code. Absolutely everybody should upgrade. + + The bug relied on an incorrect calculation when making data continuous + in one of our IO buffers, if the first chunk of the buffer was + misaligned by just the wrong amount. The miscalculation would allow an + attacker to overflow a piece of heap-allocated memory. To mount this + attack, the attacker would need to either open a SOCKS connection to + Tor's SocksPort (usually restricted to localhost), or target a Tor + instance configured to make its connections through a SOCKS proxy + (which Tor does not do by default). + + Good security practice requires that all heap-overflow bugs should be + presumed to be exploitable until proven otherwise, so we are treating + this as a potential code execution attack. Please upgrade immediately! + This bug does not affect bufferevents-based builds of Tor. Special + thanks to "Vektor" for reporting this issue to us! + + Tor 0.2.2.35 also fixes several bugs in previous versions, including + crash bugs for unusual configurations, and a long-term bug that + would that would prevent Tor from starting on Windows machines with + draconian AV software. + + With this release, we remind everyone that 0.2.0.x has reached its + formal end-of-life. Those Tor versions have many known flaws, and + nobody should be using them. You should upgrade--ideally to the + 0.2.2.x series. If you're using a Linux or BSD and its packages are + obsolete, stop using those packages and upgrade anyway. + + The Tor 0.2.1.x series is also approaching its end-of-life: it will no + longer receive support after some time in early 2012. + + o Major bugfixes: + - Fix a heap overflow bug that could occur when trying to pull + data into the first chunk of a buffer, when that chunk had + already had some data drained from it. Fixes CVE-2011-2778; + bugfix on 0.2.0.16-alpha. Reported by "Vektor". + - Initialize Libevent with the EVENT_BASE_FLAG_NOLOCK flag enabled, so + that it doesn't attempt to allocate a socketpair. This could cause + some problems on Windows systems with overzealous firewalls. Fix for + bug 4457; workaround for Libevent versions 2.0.1-alpha through + 2.0.15-stable. + - If we mark an OR connection for close based on a cell we process, + don't process any further cells on it. We already avoid further + reads on marked-for-close connections, but now we also discard the + cells we'd already read. Fixes bug 4299; bugfix on 0.2.0.10-alpha, + which was the first version where we might mark a connection for + close based on processing a cell on it. + - Correctly sanity-check that we don't underflow on a memory + allocation (and then assert) for hidden service introduction + point decryption. Bug discovered by Dan Rosenberg. Fixes bug 4410; + bugfix on 0.2.1.5-alpha. + - Fix a memory leak when we check whether a hidden service + descriptor has any usable introduction points left. Fixes bug + 4424. Bugfix on 0.2.2.25-alpha. + - Don't crash when we're running as a relay and don't have a GeoIP + file. Bugfix on 0.2.2.34; fixes bug 4340. This backports a fix + we've had in the 0.2.3.x branch already. + - When running as a client, do not print a misleading (and plain + wrong) log message that we're collecting "directory request" + statistics: clients don't collect statistics. Also don't create a + useless (because empty) stats file in the stats/ directory. Fixes + bug 4353; bugfix on 0.2.2.34. + + o Minor bugfixes: + - Detect failure to initialize Libevent. This fix provides better + detection for future instances of bug 4457. + - Avoid frequent calls to the fairly expensive cull_wedged_cpuworkers + function. This was eating up hideously large amounts of time on some + busy servers. Fixes bug 4518; bugfix on 0.0.9.8. + - Resolve an integer overflow bug in smartlist_ensure_capacity(). + Fixes bug 4230; bugfix on Tor 0.1.0.1-rc. Based on a patch by + Mansour Moufid. + - Don't warn about unused log_mutex in log.c when building with + --disable-threads using a recent GCC. Fixes bug 4437; bugfix on + 0.1.0.6-rc which introduced --disable-threads. + - When configuring, starting, or stopping an NT service, stop + immediately after the service configuration attempt has succeeded + or failed. Fixes bug 3963; bugfix on 0.2.0.7-alpha. + - When sending a NETINFO cell, include the original address + received for the other side, not its canonical address. Found + by "troll_un"; fixes bug 4349; bugfix on 0.2.0.10-alpha. + - Fix a typo in a hibernation-related log message. Fixes bug 4331; + bugfix on 0.2.2.23-alpha; found by "tmpname0901". + - Fix a memory leak in launch_direct_bridge_descriptor_fetch() that + occurred when a client tried to fetch a descriptor for a bridge + in ExcludeNodes. Fixes bug 4383; bugfix on 0.2.2.25-alpha. + - Backport fixes for a pair of compilation warnings on Windows. + Fixes bug 4521; bugfix on 0.2.2.28-beta and on 0.2.2.29-beta. + - If we had ever tried to call tor_addr_to_str on an address of + unknown type, we would have done a strdup on an uninitialized + buffer. Now we won't. Fixes bug 4529; bugfix on 0.2.1.3-alpha. + Reported by "troll_un". + - Correctly detect and handle transient lookup failures from + tor_addr_lookup. Fixes bug 4530; bugfix on 0.2.1.5-alpha. + Reported by "troll_un". + - Fix null-pointer access that could occur if TLS allocation failed. + Fixes bug 4531; bugfix on 0.2.0.20-rc. Found by "troll_un". + - Use tor_socket_t type for listener argument to accept(). Fixes bug + 4535; bugfix on 0.2.2.28-beta. Found by "troll_un". + + o Minor features: + - Add two new config options for directory authorities: + AuthDirFastGuarantee sets a bandwidth threshold for guaranteeing the + Fast flag, and AuthDirGuardBWGuarantee sets a bandwidth threshold + that is always sufficient to satisfy the bandwidth requirement for + the Guard flag. Now it will be easier for researchers to simulate + Tor networks with different values. Resolves ticket 4484. + - When Tor ignores a hidden service specified in its configuration, + include the hidden service's directory in the warning message. + Previously, we would only tell the user that some hidden service + was ignored. Bugfix on 0.0.6; fixes bug 4426. + - Update to the December 6 2011 Maxmind GeoLite Country database. + + o Packaging changes: + - Make it easier to automate expert package builds on Windows, + by removing an absolute path from makensis.exe command. + + Changes in version 0.2.2.34 - 2011-10-26 Tor 0.2.2.34 fixes a critical anonymity vulnerability where an attacker can deanonymize Tor users. Everybody should upgrade.

1 0

[tor/release-0.2.2] Actually merge the CVE-2011-2778 log entry into ChangeLog
by nickm＠torproject.org 16 Dec '11

16 Dec '11

commit 796563f7f3924fb5f2bed39cd37e1471da657cc4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 15 13:14:50 2011 -0500 Actually merge the CVE-2011-2778 log entry into ChangeLog --- ChangeLog | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) diff --git a/ChangeLog b/ChangeLog index e1bc545..98fb411 100644 --- a/ChangeLog +++ b/ChangeLog @@ -32,6 +32,10 @@ Changes in version 0.2.2.35 - 2011-12-16 longer receive support after some time in early 2011. o Major bugfixes: + - Fix a heap overflow bug that could occur when trying to pull + data into the first chunk of a buffer, when that chunk had + already had some data drained from it. Fixes CVE-2011-2778; + bugfix on 0.2.0.16-alpha. Reported by "Vektor". - Initialize Libevent with the EVENT_BASE_FLAG_NOLOCK flag enabled, so that it doesn't attempt to allocate a socketpair. This could cause some problems on Windows systems with overzealous firewalls. Fix for

1 0

[tor/maint-0.2.1] Add a fix for the buf_pullup bug that Vektor reported
by nickm＠torproject.org 16 Dec '11

16 Dec '11

commit 9d0777839be6642954a4c064c819d406d8bb7cb4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Dec 14 16:38:43 2011 -0500 Add a fix for the buf_pullup bug that Vektor reported --- changes/buffer_bug | 7 +++++++ src/or/buffers.c | 5 +++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/changes/buffer_bug b/changes/buffer_bug new file mode 100644 index 0000000..634f609 --- /dev/null +++ b/changes/buffer_bug @@ -0,0 +1,7 @@ + + o Major bugfixes: + - Fix a heap overflow bug that could occur when trying to pull + data into the first chunk of a buffer, when that chunk had + already had some data drained from it. Fixes CVE-2011-2778; + bugfix on 0.2.0.16-alpha. Reported by "Vektor". + diff --git a/src/or/buffers.c b/src/or/buffers.c index 7103746..5701604 100644 --- a/src/or/buffers.c +++ b/src/or/buffers.c @@ -375,9 +375,10 @@ buf_pullup(buf_t *buf, size_t bytes, int nulterminate) if (buf->head->memlen >= capacity) { /* We don't need to grow the first chunk, but we might need to repack it.*/ - if (CHUNK_REMAINING_CAPACITY(buf->head) < capacity-buf->datalen) + size_t needed = capacity - buf->head->datalen; + if (CHUNK_REMAINING_CAPACITY(buf->head) < needed) chunk_repack(buf->head); - tor_assert(CHUNK_REMAINING_CAPACITY(buf->head) >= capacity-buf->datalen); + tor_assert(CHUNK_REMAINING_CAPACITY(buf->head) >= needed); } else { chunk_t *newhead; size_t newsize;

1 0

[tor/maint-0.2.2] Add a fix for the buf_pullup bug that Vektor reported
by nickm＠torproject.org 16 Dec '11

16 Dec '11

commit 9d0777839be6642954a4c064c819d406d8bb7cb4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Dec 14 16:38:43 2011 -0500 Add a fix for the buf_pullup bug that Vektor reported --- changes/buffer_bug | 7 +++++++ src/or/buffers.c | 5 +++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/changes/buffer_bug b/changes/buffer_bug new file mode 100644 index 0000000..634f609 --- /dev/null +++ b/changes/buffer_bug @@ -0,0 +1,7 @@ + + o Major bugfixes: + - Fix a heap overflow bug that could occur when trying to pull + data into the first chunk of a buffer, when that chunk had + already had some data drained from it. Fixes CVE-2011-2778; + bugfix on 0.2.0.16-alpha. Reported by "Vektor". + diff --git a/src/or/buffers.c b/src/or/buffers.c index 7103746..5701604 100644 --- a/src/or/buffers.c +++ b/src/or/buffers.c @@ -375,9 +375,10 @@ buf_pullup(buf_t *buf, size_t bytes, int nulterminate) if (buf->head->memlen >= capacity) { /* We don't need to grow the first chunk, but we might need to repack it.*/ - if (CHUNK_REMAINING_CAPACITY(buf->head) < capacity-buf->datalen) + size_t needed = capacity - buf->head->datalen; + if (CHUNK_REMAINING_CAPACITY(buf->head) < needed) chunk_repack(buf->head); - tor_assert(CHUNK_REMAINING_CAPACITY(buf->head) >= capacity-buf->datalen); + tor_assert(CHUNK_REMAINING_CAPACITY(buf->head) >= needed); } else { chunk_t *newhead; size_t newsize;

1 0

[tor/maint-0.2.2] Merge remote-tracking branch 'origin/maint-0.2.1' into maint-0.2.2
by nickm＠torproject.org 16 Dec '11

16 Dec '11

commit 562c974ee7913b09bc1b19e4674dea618f2c6328 Merge: 0582746 9d07778 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 15 11:28:44 2011 -0500 Merge remote-tracking branch 'origin/maint-0.2.1' into maint-0.2.2 changes/buffer_bug | 7 +++++++ src/or/buffers.c | 5 +++-- 2 files changed, 10 insertions(+), 2 deletions(-)

1 0

[tor/master] Add a fix for the buf_pullup bug that Vektor reported
by nickm＠torproject.org 16 Dec '11

16 Dec '11

commit 9d0777839be6642954a4c064c819d406d8bb7cb4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Dec 14 16:38:43 2011 -0500 Add a fix for the buf_pullup bug that Vektor reported --- changes/buffer_bug | 7 +++++++ src/or/buffers.c | 5 +++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/changes/buffer_bug b/changes/buffer_bug new file mode 100644 index 0000000..634f609 --- /dev/null +++ b/changes/buffer_bug @@ -0,0 +1,7 @@ + + o Major bugfixes: + - Fix a heap overflow bug that could occur when trying to pull + data into the first chunk of a buffer, when that chunk had + already had some data drained from it. Fixes CVE-2011-2778; + bugfix on 0.2.0.16-alpha. Reported by "Vektor". + diff --git a/src/or/buffers.c b/src/or/buffers.c index 7103746..5701604 100644 --- a/src/or/buffers.c +++ b/src/or/buffers.c @@ -375,9 +375,10 @@ buf_pullup(buf_t *buf, size_t bytes, int nulterminate) if (buf->head->memlen >= capacity) { /* We don't need to grow the first chunk, but we might need to repack it.*/ - if (CHUNK_REMAINING_CAPACITY(buf->head) < capacity-buf->datalen) + size_t needed = capacity - buf->head->datalen; + if (CHUNK_REMAINING_CAPACITY(buf->head) < needed) chunk_repack(buf->head); - tor_assert(CHUNK_REMAINING_CAPACITY(buf->head) >= capacity-buf->datalen); + tor_assert(CHUNK_REMAINING_CAPACITY(buf->head) >= needed); } else { chunk_t *newhead; size_t newsize;

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.1' into maint-0.2.2
by nickm＠torproject.org 16 Dec '11

16 Dec '11

commit 562c974ee7913b09bc1b19e4674dea618f2c6328 Merge: 0582746 9d07778 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 15 11:28:44 2011 -0500 Merge remote-tracking branch 'origin/maint-0.2.1' into maint-0.2.2 changes/buffer_bug | 7 +++++++ src/or/buffers.c | 5 +++-- 2 files changed, 10 insertions(+), 2 deletions(-)

1 0