Description
Tor before 0.1.2.16, when ControlPort is enabled, does not properly restrict commands to localhost port 9051, which allows remote attackers to modify the torrc configuration file, compromise anonymity, and have other unspecified impact via HTTP POST data containing commands without valid authentication, as demonstrated by an HTML form (1) hosted on a web site or (2) injected by a Tor exit node.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tor | 0.1.2.16-1 | — |
| Debian 13 | tor | 0.1.2.16-1 | — |
| Debian 12 | tor | 0.1.2.16-1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 2
- Tor < 0.1.2.16 - ControlPort Remote Rewrite EDB-4468 · remote · Sep 29, 2007 · verified
- Tor 0.1.2.15 - ControlPort Missing Authentication Unauthorized Access EDB-30447 · remote · Aug 2, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 25188 vdb-entry
- tor-control-command-execution(36407) vdb-entry
- 1018510 vdb-entry
- tor-controlport-security-bypass(35784) vdb-entry
- ADV-2007-2768 vdb-entry
- 36271 vdb-entry
- 26301 third-party-advisory
- [or-announce] 20070901 Tor security advisory: cross-protocol http form attack mailing-list
- [or-announce] 20070802 Tor 0.1.2.16 is released mailing-list