February 2017 - tor-commits - lists.torproject.org

[tor/maint-0.2.6] Check for len < 4 in dn_indicates_v3_cert
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit 35bf07b8d67d018f7740ca195cf8c7c86b1b4ef9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Oct 21 11:44:43 2015 -0400 Check for len < 4 in dn_indicates_v3_cert Without this check, we potentially look up to 3 characters before the start of a malloc'd segment, which could provoke a crash under certain (weird afaik) circumstances. Fixes 17404; bugfix on 0.2.6.3-alpha. --- changes/bug17404 | 6 ++++++ src/common/tortls.c | 4 ++++ 2 files changed, 10 insertions(+) diff --git a/changes/bug17404 b/changes/bug17404 new file mode 100644 index 0000000..d524f66 --- /dev/null +++ b/changes/bug17404 @@ -0,0 +1,6 @@ + o Major bugfixes (security, correctness): + - Fix a programming error that could cause us to read 4 bytes before + the beginning of an openssl string. This could be used to provoke + a crash on systems with an unusual malloc implementation, or + systems with unsual hardening installed. Fixes bug 17404; bugfix + on 0.2.3.6-alpha. diff --git a/src/common/tortls.c b/src/common/tortls.c index 4222f6d..75ca47d 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -2676,6 +2676,10 @@ dn_indicates_v3_cert(X509_NAME *name) len = ASN1_STRING_to_UTF8(&s, str); if (len < 0) return 0; + if (len < 4) { + OPENSSL_free(s); + return 0; + } r = fast_memneq(s + len - 4, ".net", 4); OPENSSL_free(s); return r;

1 0

[tor/maint-0.2.6] Fix out-of-bounds read in INTRODUCE2 client auth
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit 053e11f397f3f890c52a1add6aa4e75a9178eba0 Author: John Brooks <john.brooks(a)dereferenced.net> Date: Sat Apr 25 22:52:35 2015 -0600 Fix out-of-bounds read in INTRODUCE2 client auth The length of auth_data from an INTRODUCE2 cell is checked when the auth_type is recognized (1 or 2), but not for any other non-zero auth_type. Later, auth_data is assumed to have at least REND_DESC_COOKIE_LEN bytes, leading to a client-triggered out of bounds read. Fixed by checking auth_len before comparing the descriptor cookie against known clients. Fixes #15823; bugfix on 0.2.1.6-alpha. --- changes/bug15823 | 4 ++++ src/or/rendservice.c | 18 ++++++++++++++---- 2 files changed, 18 insertions(+), 4 deletions(-) diff --git a/changes/bug15823 b/changes/bug15823 new file mode 100644 index 0000000..987de5d --- /dev/null +++ b/changes/bug15823 @@ -0,0 +1,4 @@ + o Minor bugfixes (hidden service): + - Fix an out-of-bounds read when parsing invalid INTRODUCE2 cells + on a client authorized hidden service. Fixes bug 15823; bugfix + on 0.2.1.6-alpha. diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 436f2f4..0a54567 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -939,11 +939,13 @@ rend_service_requires_uptime(rend_service_t *service) return 0; } -/** Check client authorization of a given descriptor_cookie for - * service. Return 1 for success and 0 for failure. */ +/** Check client authorization of a given descriptor_cookie of + * length cookie_len for service. Return 1 for success + * and 0 for failure. */ static int rend_check_authorization(rend_service_t *service, - const char *descriptor_cookie) + const char *descriptor_cookie, + size_t cookie_len) { rend_authorized_client_t *auth_client = NULL; tor_assert(service); @@ -954,6 +956,13 @@ rend_check_authorization(rend_service_t *service, return 0; } + if (cookie_len != REND_DESC_COOKIE_LEN) { + log_info(LD_REND, "Descriptor cookie is %lu bytes, but we expected " + "%lu bytes. Dropping cell.", + (unsigned long)cookie_len, (unsigned long)REND_DESC_COOKIE_LEN); + return 0; + } + /* Look up client authorization by descriptor cookie. */ SMARTLIST_FOREACH(service->clients, rend_authorized_client_t *, client, { if (tor_memeq(client->descriptor_cookie, descriptor_cookie, @@ -1300,7 +1309,8 @@ rend_service_introduce(origin_circuit_t *circuit, const uint8_t *request, if (service->clients) { if (parsed_req->version == 3 && parsed_req->u.v3.auth_len > 0) { if (rend_check_authorization(service, - (const char*)parsed_req->u.v3.auth_data)) { + (const char*)parsed_req->u.v3.auth_data, + parsed_req->u.v3.auth_len)) { log_info(LD_REND, "Authorization data in INTRODUCE2 cell are valid."); } else { log_info(LD_REND, "The authorization data that are contained in "

1 0

[tor/maint-0.2.6] Merge branch 'maint-0.2.5' into maint-0.2.6
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit 8936c50d83f3a90fb6bb3314b86f56f46d42d749 Merge: da0d5ad 05ec055 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 7 08:39:07 2017 -0500 Merge branch 'maint-0.2.5' into maint-0.2.6 changes/bug17404 | 6 ++++++ src/common/tortls.c | 4 ++++ 2 files changed, 10 insertions(+)

1 0

[tor/maint-0.2.5] Make memwipe() do nothing when passed a NULL pointer or zero size
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit fb7d1f41b409761be3381efaeec0f56d2a470a9f Author: teor (Tim Wilson-Brown) <teor2345(a)gmail.com> Date: Tue Jan 19 11:22:58 2016 +1100 Make memwipe() do nothing when passed a NULL pointer or zero size Check size argument to memwipe() for underflow. Closes bug #18089. Reported by "gk", patch by "teor". Bugfix on 0.2.3.25 and 0.2.4.6-alpha (#7352), commit 49dd5ef3 on 7 Nov 2012. --- changes/bug18089 | 6 ++++++ src/common/crypto.c | 8 ++++++++ 2 files changed, 14 insertions(+) diff --git a/changes/bug18089 b/changes/bug18089 new file mode 100644 index 0000000..c1fb342 --- /dev/null +++ b/changes/bug18089 @@ -0,0 +1,6 @@ + o Minor fixes (security): + - Make memwipe() do nothing when passed a NULL pointer + or zero size. Check size argument to memwipe() for underflow. + Closes bug #18089. Reported by "gk", patch by "teor". + Bugfix on 0.2.3.25 and 0.2.4.6-alpha (#7352), + commit 49dd5ef3 on 7 Nov 2012. diff --git a/src/common/crypto.c b/src/common/crypto.c index 925beb3..f913917 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -2972,6 +2972,7 @@ secret_to_key(char *key_out, size_t key_out_len, const char *secret, /** * Destroy the sz bytes of data stored at mem, setting them to * the value byte. + * If mem is NULL or sz is zero, nothing happens. * * This function is preferable to memset, since many compilers will happily * optimize out memset() when they can convince themselves that the data being @@ -2989,6 +2990,13 @@ secret_to_key(char *key_out, size_t key_out_len, const char *secret, void memwipe(void *mem, uint8_t byte, size_t sz) { + if (mem == NULL || sz == 0) { + return; + } + + /* Data this large is likely to be an underflow. */ + tor_assert(sz < SIZE_T_CEILING); + /* Because whole-program-optimization exists, we may not be able to just * have this function call "memset". A smart compiler could inline it, then * eliminate dead memsets, and declare itself to be clever. */

1 0

[tor/maint-0.2.6] Merge branch 'maint-0.2.4' into maint-0.2.5
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit 640b4022324c19cf330a26b8d42b6bf7707346ce Merge: 34fdd51 053e11f Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 7 08:32:10 2017 -0500 Merge branch 'maint-0.2.4' into maint-0.2.5

1 0

[tor/maint-0.2.5] Merge branch 'maint-0.2.4' into maint-0.2.5
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit 332543baedcf651b75722e5d4626c62fdd24ef60 Merge: 640b402 6cb8c0f Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 7 08:34:08 2017 -0500 Merge branch 'maint-0.2.4' into maint-0.2.5 changes/bug18089 | 6 ++++++ src/common/crypto.c | 10 ++++++++++ 2 files changed, 16 insertions(+)

1 0

[translation/tor-browser-manual] Update translations for tor-browser-manual
by translation＠torproject.org 07 Feb '17

07 Feb '17

commit ae614f112b88ce9be9fe4a59ee162015ad72d721 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Feb 7 11:48:19 2017 +0000 Update translations for tor-browser-manual --- vi/vi.po | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/vi/vi.po b/vi/vi.po index 823a9d3..c3319e8 100644 --- a/vi/vi.po +++ b/vi/vi.po @@ -1291,6 +1291,10 @@ msgid "" "default location, however the folder will be named \"tor-browser_en-US\" if " "you are running the English Tor Browser." msgstr "" +"Định vị thư mục chứa Trình duyệt Tor. Vị trí mặc định trong Windows là Màn " +"hình (Desktop); trên Mac OS X đó là thư mục Các ứng dụng (Applications). Với" +" Linux, không có thư mục mặc định; tuy nhiên thư mục đó sẽ được đặt tên " +"\"tor-browser_en-US\" nếu bạn đang dùng Trình duyệt Tor tiếng Anh." #: uninstalling.page:32 msgid "Delete the Tor Browser folder."

1 0

[translation/tor-browser-manual] Update translations for tor-browser-manual
by translation＠torproject.org 07 Feb '17

07 Feb '17

commit 51bb2e8b81675e6e8c9dc8a58a39d85f47a12c66 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Feb 7 11:18:22 2017 +0000 Update translations for tor-browser-manual --- vi/vi.po | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/vi/vi.po b/vi/vi.po index e1acbe2..823a9d3 100644 --- a/vi/vi.po +++ b/vi/vi.po @@ -1282,7 +1282,7 @@ msgstr "" #: uninstalling.page:18 msgid "Removing Tor Browser from your system is simple:" -msgstr "" +msgstr "Việc xoá bỏ Trình duyệt Tor khỏi hệ thống là đơn giản:" #: uninstalling.page:24 msgid "" @@ -1294,16 +1294,17 @@ msgstr "" #: uninstalling.page:32 msgid "Delete the Tor Browser folder." -msgstr "" +msgstr "Xoá thư mục chứa Trình duyệt Tor." #: uninstalling.page:35 msgid "Empty your Trash" -msgstr "" +msgstr "Làm sạch Thùng rác" #: uninstalling.page:39 msgid "" "Note that your operating system’s standard “Uninstall” utility is not used." msgstr "" +"Lưu ý là ứng dụng “Huỷ cài đặt” chuẩn của hệ điều hành không được sử dụng." #: updating.page:6 msgid "How to update Tor Browser"

1 0

[translation/tor-browser-manual] Update translations for tor-browser-manual
by translation＠torproject.org 07 Feb '17

07 Feb '17

commit 50e205c1388970ddd85e97e6302f6bed109d7f7b Author: Translation commit bot <translation(a)torproject.org> Date: Tue Feb 7 05:48:19 2017 +0000 Update translations for tor-browser-manual --- tr/tr.po | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/tr/tr.po b/tr/tr.po index a56f517..32f517f 100644 --- a/tr/tr.po +++ b/tr/tr.po @@ -62,12 +62,18 @@ msgid "" "real Internet (IP) address, and will not know who you are unless you " "explicitly identify yourself." msgstr "" +"Web sitesi ve kullandığınız hizmetleri işletenler ve onları izleyenler " +"gerçek İnternet (IP) adresiniz yerine yalnız Tor ağından bir bağlantı " +"geldiğini görür ve siz kendinizi açık etmedikçe kim olduğunuzu bilemez." #: about-tor-browser.page:34 msgid "" "In addition, Tor Browser is designed to prevent websites from " "“fingerprinting” or identifying you based on your browser configuration." msgstr "" +"Ek olarak Tor Browser, web sitelerinin \"parmak izi\" taraması yapmasını ya " +"da web tarayıcı ayarlarınıza göre sizin kim olduğunuzun belirlenmesini " +"engeller." #: about-tor-browser.page:39 msgid "" @@ -75,6 +81,10 @@ msgid "" " valid for a single session (until Tor Browser is exited or a <link xref" "=\"managing-identities#new-identity\">New Identity</link> is requested)." msgstr "" +"Varsayılan olarak Tor Browser tarama geçmişini kaydetmez. Çerezler yalnız " +"tek bir oturum için geçerlidir (Tor Browser kapatılana ya da <link xref" +"=\"managing-identities#new-identity\">Yeni Kimlik</link> bağşantısına " +"tıklanana kadar)." #: about-tor-browser.page:50 msgid "How Tor works"

1 0

[translation/tor-browser-manual] Update translations for tor-browser-manual
by translation＠torproject.org 07 Feb '17

07 Feb '17

commit 9f3188ac912937cd650c1c440474a312e103e659 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Feb 7 05:18:25 2017 +0000 Update translations for tor-browser-manual --- tr/tr.po | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/tr/tr.po b/tr/tr.po index 4ead03a..a56f517 100644 --- a/tr/tr.po +++ b/tr/tr.po @@ -42,6 +42,8 @@ msgid "" "Tor Browser uses the Tor network to protect your privacy and anonymity. " "Using the Tor network has two main properties:" msgstr "" +"Tor Browser kişisel gizliliğinizi ve ağ üzerinde adsız kalmanızı sağlamak " +"için Tor ağını kullanılır. Tor ağı kullanmanın iki ana amacı vardır:" #: about-tor-browser.page:18 msgid "" @@ -49,6 +51,9 @@ msgid "" " will not be able to track your internet activity, including the names and " "addresses of the websites you visit." msgstr "" +"İnternet hizmeti sağlayıcınız ya da bağlantınızı yerel olarak izleyenler, " +"İnternet üzerinde yaptığınız işlemleri ve ziyaret ettiğiniz web sitelerinin " +"ad ve adreslerini izleyemez." #: about-tor-browser.page:25 msgid ""

1 0