[tor-dev] [tor-announce] Tor is released (security patches)

Fabio Pietrosanti (naif) lists at infosecurity.ch
Sat Dec 17 09:50:26 UTC 2011

Should we think to have all tor-users that run a version minor than X,
go automatically off-the-network?

I mean, if we have let's say 10% of outdated users, it means that 10% of
the network can be compromised with a single remote exploit.

I mean, running a Tor node today it's a responsibility.

If a node maintainer it not going to update within a possibly defined
grace period, it should imho get kicked-out from the network.

Has been this concept already considered somehow?
I mean, at least if a node is not updated for example, it would never be
able to achieve a certain "status" or functionalities.
For example never become a Guard node or never became an Exit Node?


On 12/16/11 7:19 PM, Roger Dingledine wrote:
> Tor fixes a critical heap-overflow security issue in Tor's
> buffers code. Absolutely everybody should upgrade.
> The bug relied on an incorrect calculation when making data continuous
> in one of our IO buffers, if the first chunk of the buffer was
> misaligned by just the wrong amount. The miscalculation would allow an
> attacker to overflow a piece of heap-allocated memory. To mount this
> attack, the attacker would need to either open a SOCKS connection to
> Tor's SocksPort (usually restricted to localhost), or target a Tor
> instance configured to make its connections through a SOCKS proxy
> (which Tor does not do by default).
> Good security practice requires that all heap-overflow bugs should be
> presumed to be exploitable until proven otherwise, so we are treating
> this as a potential code execution attack. Please upgrade immediately!
> This bug does not affect bufferevents-based builds of Tor. Special
> thanks to "Vektor" for reporting this issue to us!
> Tor also fixes several bugs in previous versions, including
> crash bugs for unusual configurations, and a long-term bug that
> would prevent Tor from starting on Windows machines with draconian
> AV software.
> With this release, we remind everyone that 0.2.0.x has reached its
> formal end-of-life. Those Tor versions have many known flaws, and
> nobody should be using them. You should upgrade -- ideally to the
> 0.2.2.x series. If you're using a Linux or BSD and its packages are
> obsolete, stop using those packages and upgrade anyway.
> The Tor 0.2.1.x series is also approaching its end-of-life: it will no
> longer receive support after some time in early 2012.
> https://www.torproject.org/download/download
> Note that the tarball and git tags are signed by Nick Mathewson (gpg
> key 165733EA) this time around.
> Changes in version - 2011-12-16
>   o Major bugfixes:
>     - Fix a heap overflow bug that could occur when trying to pull
>       data into the first chunk of a buffer, when that chunk had
>       already had some data drained from it. Fixes CVE-2011-2778;
>       bugfix on Reported by "Vektor".
>     - Initialize Libevent with the EVENT_BASE_FLAG_NOLOCK flag enabled, so
>       that it doesn't attempt to allocate a socketpair. This could cause
>       some problems on Windows systems with overzealous firewalls. Fix for
>       bug 4457; workaround for Libevent versions 2.0.1-alpha through
>       2.0.15-stable.
>     - If we mark an OR connection for close based on a cell we process,
>       don't process any further cells on it. We already avoid further
>       reads on marked-for-close connections, but now we also discard the
>       cells we'd already read. Fixes bug 4299; bugfix on,
>       which was the first version where we might mark a connection for
>       close based on processing a cell on it.
>     - Correctly sanity-check that we don't underflow on a memory
>       allocation (and then assert) for hidden service introduction
>       point decryption. Bug discovered by Dan Rosenberg. Fixes bug 4410;
>       bugfix on
>     - Fix a memory leak when we check whether a hidden service
>       descriptor has any usable introduction points left. Fixes bug
>       4424. Bugfix on
>     - Don't crash when we're running as a relay and don't have a GeoIP
>       file. Bugfix on; fixes bug 4340. This backports a fix
>       we've had in the 0.2.3.x branch already.
>     - When running as a client, do not print a misleading (and plain
>       wrong) log message that we're collecting "directory request"
>       statistics: clients don't collect statistics. Also don't create a
>       useless (because empty) stats file in the stats/ directory. Fixes
>       bug 4353; bugfix on
>   o Minor bugfixes:
>     - Detect failure to initialize Libevent. This fix provides better
>       detection for future instances of bug 4457.
>     - Avoid frequent calls to the fairly expensive cull_wedged_cpuworkers
>       function. This was eating up hideously large amounts of time on some
>       busy servers. Fixes bug 4518; bugfix on
>     - Resolve an integer overflow bug in smartlist_ensure_capacity().
>       Fixes bug 4230; bugfix on Tor Based on a patch by
>       Mansour Moufid.
>     - Don't warn about unused log_mutex in log.c when building with
>       --disable-threads using a recent GCC. Fixes bug 4437; bugfix on
> which introduced --disable-threads.
>     - When configuring, starting, or stopping an NT service, stop
>       immediately after the service configuration attempt has succeeded
>       or failed. Fixes bug 3963; bugfix on
>     - When sending a NETINFO cell, include the original address
>       received for the other side, not its canonical address. Found
>       by "troll_un"; fixes bug 4349; bugfix on
>     - Fix a typo in a hibernation-related log message. Fixes bug 4331;
>       bugfix on; found by "tmpname0901".
>     - Fix a memory leak in launch_direct_bridge_descriptor_fetch() that
>       occurred when a client tried to fetch a descriptor for a bridge
>       in ExcludeNodes. Fixes bug 4383; bugfix on
>     - Backport fixes for a pair of compilation warnings on Windows.
>       Fixes bug 4521; bugfix on and on
>     - If we had ever tried to call tor_addr_to_str on an address of
>       unknown type, we would have done a strdup on an uninitialized
>       buffer. Now we won't. Fixes bug 4529; bugfix on
>       Reported by "troll_un".
>     - Correctly detect and handle transient lookup failures from
>       tor_addr_lookup. Fixes bug 4530; bugfix on
>       Reported by "troll_un".
>     - Fix null-pointer access that could occur if TLS allocation failed.
>       Fixes bug 4531; bugfix on Found by "troll_un".
>     - Use tor_socket_t type for listener argument to accept(). Fixes bug
>       4535; bugfix on Found by "troll_un".
>   o Minor features:
>     - Add two new config options for directory authorities:
>       AuthDirFastGuarantee sets a bandwidth threshold for guaranteeing the
>       Fast flag, and AuthDirGuardBWGuarantee sets a bandwidth threshold
>       that is always sufficient to satisfy the bandwidth requirement for
>       the Guard flag. Now it will be easier for researchers to simulate
>       Tor networks with different values. Resolves ticket 4484.
>     - When Tor ignores a hidden service specified in its configuration,
>       include the hidden service's directory in the warning message.
>       Previously, we would only tell the user that some hidden service
>       was ignored. Bugfix on 0.0.6; fixes bug 4426.
>     - Update to the December 6 2011 Maxmind GeoLite Country database.
>   o Packaging changes:
>     - Make it easier to automate expert package builds on Windows,
>       by removing an absolute path from makensis.exe command.
> _______________________________________________
> tor-announce mailing list
> tor-announce at lists.torproject.org
> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-announce

More information about the tor-dev mailing list