FreeBSD: VID-847F16E5-9406-11ED-A925-3065EC8FD3EC: security/tor -- SOCKS4(a) inversion bug

FreeBSD: VID-847F16E5-9406-11ED-A925-3065EC8FD3EC: security/tor -- SOCKS4(a) inversion bug

Severity

4

CVSS

(AV:L/AC:M/Au:N/C:P/I:P/A:P)

Published

01/12/2023

Created

01/17/2023

Added

01/15/2023

Modified

01/15/2023

Description

The Tor Project reports:

TROVE-2022-002: The SafeSocks option for SOCKS4(a) is inverted leading to SOCKS4 going through

This is a report from hackerone:

We have classified this as medium considering that tor was not defending in-depth for dangerous SOCKS request and so any user relying on SafeSocks 1 to make sure they don't link DNS leak and their Tor traffic wasn't safe afterall for SOCKS4(a).

Tor Browser doesn't use SafeSocks 1 and SOCKS4 so at least the likely vast majority of users are not affected.

Solution(s)

• freebsd-upgrade-package-tor