Description
Tor before 0.2.0.32 does not properly process the ClientDNSRejectInternalAddresses configuration option in situations where an exit relay issues a policy-based refusal of a stream, which allows remote exit relays to have an unknown impact by mapping an internal IP address to the destination hostname of a refused stream.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tor | 0.2.0.32-1 | — |
| Debian 13 | tor | 0.2.0.32-1 | — |
| Debian 12 | tor | 0.2.0.32-1 | — |
References
- tor-clientdnsreject-security-bypass(47102) vdb-entry
- 34583 third-party-advisory
- 32648 vdb-entry
- 33025 third-party-advisory
- ADV-2008-3366 vdb-entry
- http://blog.torproject.org/blog/tor-0.2.0.32-released
- GLSA-200904-11 vendor-advisory