Description
Tor does not verify a node's uptime and bandwidth advertisements, which allows remote attackers who operate a low resource node to make false claims of greater resources, which places the node into use for many circuits and compromises the anonymity of traffic sources and destinations.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tor | No fix yet | — |
| Debian 13 | tor | No fix yet | — |
| Debian 12 | tor | No fix yet | — |
References
- [or-talk] 20070225 "Low-Resource Routing Attacks Against Anonymous Systems" mailing-list
- [or-talk] 20070225 Re: ISP controlling entry/exti ("Low-Resource Routing Attacks Against Anonymous Systems") mailing-list
- http://www.cs.colorado.edu/department/publications/reports/docs/CU-CS-1025-07.pdf
- [or-talk] 20070225 Re: "Low-Resource Routing Attacks Against Anonymous Systems" mailing-list
- 45249 vdb-entry