Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2017-0376: Tor Hidden Service Crashes When Abused, Disrupting Anonymity
CVE-2017-0376 · published 9 years ago
Summary
A bug in Tor's hidden service feature can cause the service to crash and stop working if a malicious actor sends a specific type of message. This could potentially disrupt the anonymity of users relying on Tor's hidden services. Update to the latest version of Tor to fix this issue.
What to do
- Update torproject tor to version 0.3.0.8 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| torproject | tor |
< 0.3.0.8 cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:* |
| debian | debian_linux |
8.0 9.0 cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
Original advisory text
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvo...
The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit.
References
- http://www.debian.org/security/2017/dsa-3877 Third Party Advisory
- https://github.com/torproject/tor/commit/56a7c5bc15e0447203a491c1ee37de9939ad1dc... Issue Tracking Patch Third Party Advisory
- https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html Mailing List Third Party Advisory
- https://trac.torproject.org/projects/tor/ticket/22494 Issue Tracking Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-617Reachable Assertion
Timeline
Published9 Jun 2017
Updated4 Nov 2026
First seen10 Apr 2026
Track software like this
Free during beta