NVD Vulnerability Detail

CVE-2012-5573

Summary	The connection_edge_process_relay_cell function in or/relay.c in Tor before 0.2.3.25 maintains circuits even if an unexpected SENDME cell arrives, which might allow remote attackers to cause a denial of service (memory consumption or excessive cell reception rate) or bypass intended flow-control restrictions via a RELAY_COMMAND_SENDME command.
Publication Date	Jan. 1, 2013, 9:35 p.m.
Registration Date	Jan. 28, 2021, 3:06 p.m.
Last Update	Nov. 21, 2024, 10:44 a.m.

CVSS2.0 : MEDIUM
Score	5.0
Vector	AV:N/AC:L/Au:N/C:N/I:N/A:P
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	なし
完全性への影響(I)	なし
可用性への影響(A)	低
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:torproject:tor:0.2.0.33:::::::*
cpe:2.3:a:torproject:tor:0.1.1.22:::::::*
cpe:2.3:a:torproject:tor:0.0.9.4:::::::*
cpe:2.3:a:torproject:tor:0.2.2.35:::::::*
cpe:2.3:a:torproject:tor:0.2.2.29:::::::*
cpe:2.3:a:torproject:tor:0.0.9.1:::::::*
cpe:2.3:a:torproject:tor:0.1.1.20:::::::*
cpe:2.3:a:torproject:tor:0.0.2:pre14::::::
cpe:2.3:a:torproject:tor:0.2.0.35:::::::*
cpe:2.3:a:torproject:tor:0.2.2.32:::::::*
cpe:2.3:a:torproject:tor:0.0.3:::::::*
cpe:2.3:a:torproject:tor:0.0.2:pre17::::::
cpe:2.3:a:torproject:tor:0.1.1.23:::::::*
cpe:2.3:a:torproject:tor:0.2.3.23:rc::::::
cpe:2.3:a:torproject:tor:0.2.2.24:::::::*
cpe:2.3:a:torproject:tor:0.2.2.37:::::::*
cpe:2.3:a:torproject:tor:0.1.0.14:::::::*
cpe:2.3:a:torproject:tor:0.1.2.15:::::::*
cpe:2.3:a:torproject:tor:0.2.2.21:::::::*
cpe:2.3:a:torproject:tor:0.2.3.13:alpha::::::
cpe:2.3:a:torproject:tor:0.0.6.1:::::::*
cpe:2.3:a:torproject:tor:0.0.8.1:::::::*
cpe:2.3:a:torproject:tor:0.1.0.11:::::::*
cpe:2.3:a:torproject:tor:0.0.9.6:::::::*
cpe:2.3:a:torproject:tor:0.1.2.14:::::::*
cpe:2.3:a:torproject:tor:0.0.5:::::::*
cpe:2.3:a:torproject:tor:0.2.0.30:::::::*
cpe:2.3:a:torproject:tor:0.0.7.1:::::::*
cpe:2.3:a:torproject:tor:0.0.9.7:::::::*
cpe:2.3:a:torproject:tor:0.2.2.19:::::::*
cpe:2.3:a:torproject:tor:0.2.3:::::::*
cpe:2.3:a:torproject:tor:0.0.2:pre26::::::
cpe:2.3:a:torproject:tor:0.1.0.15:::::::*
cpe:2.3:a:torproject:tor:0.1.1.24:::::::*
cpe:2.3:a:torproject:tor:0.0.6.2:::::::*
cpe:2.3:a:torproject:tor:0.2.2.28:::::::*
cpe:2.3:a:torproject:tor:0.2.2.23:::::::*
cpe:2.3:a:torproject:tor:0.2.3.20:rc::::::
cpe:2.3:a:torproject:tor:0.1.0.16:::::::*
cpe:2.3:a:torproject:tor:0.2.2.18:::::::*
cpe:2.3:a:torproject:tor:0.0.6:::::::*
cpe:2.3:a:torproject:tor:0.2.2.22:::::::*
cpe:2.3:a:torproject:tor:0.2.2.27:::::::*
cpe:2.3:a:torproject:tor:0.1.0.17:::::::*
cpe:2.3:a:torproject:tor:0.2.2.38:::::::*
cpe:2.3:a:torproject:tor:0.0.2:pre24::::::
cpe:2.3:a:torproject:tor:0.2.3.21:rc::::::
cpe:2.3:a:torproject:tor:0.0.2:pre21::::::
cpe:2.3:a:torproject:tor:0.2.3.18:rc::::::
cpe:2.3:a:torproject:tor:0.1.0.10:::::::*
cpe:2.3:a:torproject:tor:0.2.2.34:::::::*
cpe:2.3:a:torproject:tor:0.0.7.3:::::::*
cpe:2.3:a:torproject:tor:0.0.2:pre19::::::
cpe:2.3:a:torproject:tor:0.0.2:pre13::::::
cpe:2.3:a:torproject:tor:0.0.2:::::::*
cpe:2.3:a:torproject:tor:0.0.7.2:::::::*
cpe:2.3:a:torproject:tor:0.0.2:pre23::::::
cpe:2.3:a:torproject:tor:0.1.2.16:::::::*
cpe:2.3:a:torproject:tor:0.1.1.25:::::::*
cpe:2.3:a:torproject:tor:0.0.9.9:::::::*
cpe:2.3:a:torproject:tor:0.1.2.17:::::::*
cpe:2.3:a:torproject:tor:0.2.0.32:::::::*
cpe:2.3:a:torproject:tor:0.2.3.16:alpha::::::
cpe:2.3:a:torproject:tor:0.0.9.5:::::::*
cpe:2.3:a:torproject:tor:0.0.2:pre16::::::
cpe:2.3:a:torproject:tor:0.2.3.14:alpha::::::
cpe:2.3:a:torproject:tor:0.2.2.31:::::::*
cpe:2.3:a:torproject:tor:0.2.2.36:::::::*
cpe:2.3:a:torproject:tor:0.1.1.21:::::::*
cpe:2.3:a:torproject:tor:0.2.0.34:::::::*
cpe:2.3:a:torproject:tor:0.2.2.30:::::::*
cpe:2.3:a:torproject:tor:0.2.3.15:alpha::::::
cpe:2.3:a:torproject:tor:0.0.7:::::::*
cpe:2.3:a:torproject:tor:0.0.2:pre27::::::
cpe:2.3:a:torproject:tor:0.0.9.3:::::::*
cpe:2.3:a:torproject:tor:0.1.0.13:::::::*
cpe:2.3:a:torproject:tor:0.0.9.8:::::::*
cpe:2.3:a:torproject:tor:0.1.1.26:::::::*
cpe:2.3:a:torproject:tor:0.2.2.20:::::::*
cpe:2.3:a:torproject:tor:0.0.2:pre20::::::
cpe:2.3:a:torproject:tor:0.2.2.25:::::::*
cpe:2.3:a:torproject:tor:0.0.2:pre25::::::
cpe:2.3:a:torproject:tor:0.2.2.33:::::::*
cpe:2.3:a:torproject:tor:0.1.2.19:::::::*
cpe:2.3:a:torproject:tor:0.2.3.22:rc::::::
cpe:2.3:a:torproject:tor:0.0.2:pre15::::::
cpe:2.3:a:torproject:tor:0.2.3.17:beta::::::
cpe:2.3:a:torproject:tor:0.2.0.31:::::::*
cpe:2.3:a:torproject:tor:0.1.2.18:::::::*
cpe:2.3:a:torproject:tor:0.0.9.2:::::::*
cpe:2.3:a:torproject:tor::rc::::::*		0.2.3.24
cpe:2.3:a:torproject:tor:0.2.2.26:::::::*
cpe:2.3:a:torproject:tor:0.0.2:pre22::::::
cpe:2.3:a:torproject:tor:0.1.0.12:::::::*
cpe:2.3:a:torproject:tor:0.0.9.10:::::::*
cpe:2.3:a:torproject:tor:0.0.4:::::::*
cpe:2.3:a:torproject:tor:0.1.2.13:::::::*
cpe:2.3:a:torproject:tor:0.2.3.19:rc::::::
cpe:2.3:a:torproject:tor:0.0.2:pre18::::::

Related information, measures and tools

No	URL	タグ
1	http://openwall.com/lists/oss-security/2012/11/26/11
2	http://openwall.com/lists/oss-security/2012/11/26/11
3	http://secunia.com/advisories/51329
4	http://secunia.com/advisories/51329
5	http://security.gentoo.org/glsa/glsa-201301-03.xml
6	http://security.gentoo.org/glsa/glsa-201301-03.xml
7	https://bugs.gentoo.org/show_bug.cgi?id=444804
8	https://bugs.gentoo.org/show_bug.cgi?id=444804
9	https://bugzilla.redhat.com/show_bug.cgi?id=880310
10	https://bugzilla.redhat.com/show_bug.cgi?id=880310
11	https://exchange.xforce.ibmcloud.com/vulnerabilities/80289
12	https://exchange.xforce.ibmcloud.com/vulnerabilities/80289
13	https://gitweb.torproject.org/arma/tor.git/commitdiff/b9b54568c0bb64c32bd0b362954bdbc8c1234b16	Patch
14	https://gitweb.torproject.org/arma/tor.git/commitdiff/b9b54568c0bb64c32bd0b362954bdbc8c1234b16	Patch
15	https://gitweb.torproject.org/tor.git/blob/release-0.2.3:/ReleaseNotes
16	https://gitweb.torproject.org/tor.git/blob/release-0.2.3:/ReleaseNotes
17	https://trac.torproject.org/projects/tor/ticket/6252	Vendor Advisory
18	https://trac.torproject.org/projects/tor/ticket/6252	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-399	リソース管理の問題	https://cwe.mitre.org/data/definitions/399.html

JVN Vulnerability Information

Tor の or/relay.c におけるサービス運用妨害 (DoS) の脆弱性

Title	Tor の or/relay.c におけるサービス運用妨害 (DoS) の脆弱性
Summary	Tor の or/relay.c 内の connection_edge_process_relay_cell 関数は、予期しない SENDME セルを受信した場合もサーキットを維持するため、サービス運用妨害 (メモリ消費または過剰なセル受信率) 状態となる、またはフロー制御の制限を回避される脆弱性が存在します。
Possible impacts	第三者により、RELAY_COMMAND_SENDME コマンドを介して、サービス運用妨害 (メモリ消費または過剰なセル受信率) 状態にされる、またはフロー制御の制限を回避される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	June 28, 2012, midnight
Registration Date	Jan. 7, 2013, 11:35 a.m.
Last Update	Jan. 7, 2013, 11:35 a.m.

Affected System

The Tor Project

Tor 0.2.3.25 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-5573	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5573
National Vulnerability Database (NVD)
2	CVE-2012-5573	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5573

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-399	https://jvndb.jvn.jp/ja/cwe/CWE-399.html

ベンダー情報

No	Name	URL
Gentoo's Bugzilla
1	Bug 444804	https://bugs.gentoo.org/show_bug.cgi?id=444804
Red Hat Bugzilla
2	Bug 880310	https://bugzilla.redhat.com/show_bug.cgi?id=880310
Tor
3	arma/tor.git / commitdiff	https://gitweb.torproject.org/arma/tor.git/commitdiff/b9b54568c0bb64c32bd0b362954bdbc8c1234b16
4	Ticket #6252	https://trac.torproject.org/projects/tor/ticket/6252
5	tor.git / blob	https://gitweb.torproject.org/tor.git/blob/release-0.2.3:/ReleaseNotes

Change Log

No	Changed Details	Date of change
0	[2013年01月07日] 掲載	Feb. 17, 2018, 10:37 a.m.

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:torproject:tor:0.2.0.33:::::::*
cpe:2.3:a:torproject:tor:0.1.1.22:::::::*
cpe:2.3:a:torproject:tor:0.0.9.4:::::::*
cpe:2.3:a:torproject:tor:0.2.2.35:::::::*
cpe:2.3:a:torproject:tor:0.2.2.29:::::::*
cpe:2.3:a:torproject:tor:0.0.9.1:::::::*
cpe:2.3:a:torproject:tor:0.1.1.20:::::::*
cpe:2.3:a:torproject:tor:0.0.2:pre14::::::
cpe:2.3:a:torproject:tor:0.2.0.35:::::::*
cpe:2.3:a:torproject:tor:0.2.2.32:::::::*
cpe:2.3:a:torproject:tor:0.0.3:::::::*
cpe:2.3:a:torproject:tor:0.0.2:pre17::::::
cpe:2.3:a:torproject:tor:0.1.1.23:::::::*
cpe:2.3:a:torproject:tor:0.2.3.23:rc::::::
cpe:2.3:a:torproject:tor:0.2.2.24:::::::*
cpe:2.3:a:torproject:tor:0.2.2.37:::::::*
cpe:2.3:a:torproject:tor:0.1.0.14:::::::*
cpe:2.3:a:torproject:tor:0.1.2.15:::::::*
cpe:2.3:a:torproject:tor:0.2.2.21:::::::*
cpe:2.3:a:torproject:tor:0.2.3.13:alpha::::::
cpe:2.3:a:torproject:tor:0.0.6.1:::::::*
cpe:2.3:a:torproject:tor:0.0.8.1:::::::*
cpe:2.3:a:torproject:tor:0.1.0.11:::::::*
cpe:2.3:a:torproject:tor:0.0.9.6:::::::*
cpe:2.3:a:torproject:tor:0.1.2.14:::::::*
cpe:2.3:a:torproject:tor:0.0.5:::::::*
cpe:2.3:a:torproject:tor:0.2.0.30:::::::*
cpe:2.3:a:torproject:tor:0.0.7.1:::::::*
cpe:2.3:a:torproject:tor:0.0.9.7:::::::*
cpe:2.3:a:torproject:tor:0.2.2.19:::::::*
cpe:2.3:a:torproject:tor:0.2.3:::::::*
cpe:2.3:a:torproject:tor:0.0.2:pre26::::::
cpe:2.3:a:torproject:tor:0.1.0.15:::::::*
cpe:2.3:a:torproject:tor:0.1.1.24:::::::*
cpe:2.3:a:torproject:tor:0.0.6.2:::::::*
cpe:2.3:a:torproject:tor:0.2.2.28:::::::*
cpe:2.3:a:torproject:tor:0.2.2.23:::::::*
cpe:2.3:a:torproject:tor:0.2.3.20:rc::::::
cpe:2.3:a:torproject:tor:0.1.0.16:::::::*
cpe:2.3:a:torproject:tor:0.2.2.18:::::::*
cpe:2.3:a:torproject:tor:0.0.6:::::::*
cpe:2.3:a:torproject:tor:0.2.2.22:::::::*
cpe:2.3:a:torproject:tor:0.2.2.27:::::::*
cpe:2.3:a:torproject:tor:0.1.0.17:::::::*
cpe:2.3:a:torproject:tor:0.2.2.38:::::::*
cpe:2.3:a:torproject:tor:0.0.2:pre24::::::
cpe:2.3:a:torproject:tor:0.2.3.21:rc::::::
cpe:2.3:a:torproject:tor:0.0.2:pre21::::::
cpe:2.3:a:torproject:tor:0.2.3.18:rc::::::
cpe:2.3:a:torproject:tor:0.1.0.10:::::::*
cpe:2.3:a:torproject:tor:0.2.2.34:::::::*
cpe:2.3:a:torproject:tor:0.0.7.3:::::::*
cpe:2.3:a:torproject:tor:0.0.2:pre19::::::
cpe:2.3:a:torproject:tor:0.0.2:pre13::::::
cpe:2.3:a:torproject:tor:0.0.2:::::::*
cpe:2.3:a:torproject:tor:0.0.7.2:::::::*
cpe:2.3:a:torproject:tor:0.0.2:pre23::::::
cpe:2.3:a:torproject:tor:0.1.2.16:::::::*
cpe:2.3:a:torproject:tor:0.1.1.25:::::::*
cpe:2.3:a:torproject:tor:0.0.9.9:::::::*
cpe:2.3:a:torproject:tor:0.1.2.17:::::::*
cpe:2.3:a:torproject:tor:0.2.0.32:::::::*
cpe:2.3:a:torproject:tor:0.2.3.16:alpha::::::
cpe:2.3:a:torproject:tor:0.0.9.5:::::::*
cpe:2.3:a:torproject:tor:0.0.2:pre16::::::
cpe:2.3:a:torproject:tor:0.2.3.14:alpha::::::
cpe:2.3:a:torproject:tor:0.2.2.31:::::::*
cpe:2.3:a:torproject:tor:0.2.2.36:::::::*
cpe:2.3:a:torproject:tor:0.1.1.21:::::::*
cpe:2.3:a:torproject:tor:0.2.0.34:::::::*
cpe:2.3:a:torproject:tor:0.2.2.30:::::::*
cpe:2.3:a:torproject:tor:0.2.3.15:alpha::::::
cpe:2.3:a:torproject:tor:0.0.7:::::::*
cpe:2.3:a:torproject:tor:0.0.2:pre27::::::
cpe:2.3:a:torproject:tor:0.0.9.3:::::::*
cpe:2.3:a:torproject:tor:0.1.0.13:::::::*
cpe:2.3:a:torproject:tor:0.0.9.8:::::::*
cpe:2.3:a:torproject:tor:0.1.1.26:::::::*
cpe:2.3:a:torproject:tor:0.2.2.20:::::::*
cpe:2.3:a:torproject:tor:0.0.2:pre20::::::
cpe:2.3:a:torproject:tor:0.2.2.25:::::::*
cpe:2.3:a:torproject:tor:0.0.2:pre25::::::
cpe:2.3:a:torproject:tor:0.2.2.33:::::::*
cpe:2.3:a:torproject:tor:0.1.2.19:::::::*
cpe:2.3:a:torproject:tor:0.2.3.22:rc::::::
cpe:2.3:a:torproject:tor:0.0.2:pre15::::::
cpe:2.3:a:torproject:tor:0.2.3.17:beta::::::
cpe:2.3:a:torproject:tor:0.2.0.31:::::::*
cpe:2.3:a:torproject:tor:0.1.2.18:::::::*
cpe:2.3:a:torproject:tor:0.0.9.2:::::::*
cpe:2.3:a:torproject:tor::rc::::::*		0.2.3.24
cpe:2.3:a:torproject:tor:0.2.2.26:::::::*
cpe:2.3:a:torproject:tor:0.0.2:pre22::::::
cpe:2.3:a:torproject:tor:0.1.0.12:::::::*
cpe:2.3:a:torproject:tor:0.0.9.10:::::::*
cpe:2.3:a:torproject:tor:0.0.4:::::::*
cpe:2.3:a:torproject:tor:0.1.2.13:::::::*
cpe:2.3:a:torproject:tor:0.2.3.19:rc::::::
cpe:2.3:a:torproject:tor:0.0.2:pre18::::::