CVE-2009-0654 Information disclosure in n/a
Remote attackers controlling entry and exit routers can confirm communication between sender and receiver by observing cell recognition errors.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2009-0654?
CVE-2009-0654 is a medium-severity vulnerability in Tor Tor, published on 20 Feb 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tor 0.2.0.28, and probably 0.2.0.34 and earlier, allows remote attackers, with control of an entry router and an exit router, to confirm that a sender and receiver are communicating via vectors involving (1) replaying, (2) modifying, (3) inserting, or (4) deleting a single cell, and then observing cell recognition errors at the exit router. NOTE: the vendor disputes the significance of this issue, noting that the product's design "accepted end-to-end correlation as an attack that is too expensive to solve."
Which versions are affected by CVE-2009-0654?
It affects 1 product.
Products include Tor Tor.
How do I fix CVE-2009-0654?
No fix has been published for CVE-2009-0654 yet. Limit exposure of the affected software until one is available.
Is CVE-2009-0654 being exploited?
There is no known exploitation of CVE-2009-0654 in the wild and no public exploit code.
Other vulnerabilities in Tor Tor
- CVE-2010-1676 Memory corruption in n/a
- CVE-2009-0939 Tor before 0.2.0.34 treats incomplete IPv4 addresses as valid, which has unknown impact and attack vectors related to "Spec conformance," as
- CVE-2009-0414 Memory corruption in n/a
- CVE-2008-5398 Information disclosure in n/a
- CVE-2011-2778 Memory corruption in n/a
Sources
Also known as DEBIAN-CVE-2009-0654, GHSA-39qj-vvc5-79wf.