Bug 19145

Summary: tor 0.2.8.9 fixes CVE-2016-8860
Product: Mageia Reporter: David Walser <luigiwalser>
Component: SecurityAssignee: QA Team <qa-bugs>
Status: RESOLVED FIXED QA Contact: Sec team <security>
Severity: normal    
Priority: Normal CC: davidwhodgins, jani.valimaa, lewyssmith, sysadmin-bugs
Version: 5Keywords: validated_update
Target Milestone: ---   
Hardware: All   
OS: Linux   
URL: http://lwn.net/Vulnerabilities/703977/
Whiteboard: has_procedure MGA5-64-OK advisory
Source RPM: tor-0.2.7.6-3.mga6.src.rpm CVE: CVE-2016-8860
Status comment:

Description David Walser 2016-08-07 20:02:02 CEST
Tor 0.2.8.6 has been released on August 2:
https://blog.torproject.org/blog/tor-0286-released

It has several security fixes/improvements and other changes and should probably be updated.
Comment 1 Jani Välimaa 2016-08-07 20:30:46 CEST
New version is now available in SVN.

http://svnweb.mageia.org/packages?view=revision&revision=1044940
Comment 2 David Walser 2016-08-10 00:38:13 CEST
Pushed in Cauldron.  Thanks!

I suppose we should update this for Mageia 5 too.

Version: Cauldron => 5

Comment 3 David Walser 2016-08-25 14:23:49 CEST
Tor 0.2.8.7 has been released on August 24:
https://blog.torproject.org/blog/tor-0287-released-important-fixes

It looks like it should be updated again.

Summary: tor 0.2.8.6 => tor 0.2.8.7

Comment 4 David Walser 2016-09-24 16:22:52 CEST
Tor 0.2.8.8 has been released on September 23:
https://blog.torproject.org/blog/tor-0288-released-important-fixes

It's just a bugfix release.
Comment 5 David Walser 2016-10-18 12:33:49 CEST
Tor 0.2.8.9 has been released on October 17:
https://blog.torproject.org/blog/tor-0289-released-important-fixes

It fixes another security issue.

Summary: tor 0.2.8.7 => tor 0.2.8.9

Comment 6 David Walser 2016-10-18 20:50:41 CEST
(In reply to David Walser from comment #5)
> Tor 0.2.8.9 has been released on October 17:
> https://blog.torproject.org/blog/tor-0289-released-important-fixes
> 
> It fixes another security issue.

CVE request:
http://openwall.com/lists/oss-security/2016/10/18/11
Comment 7 David Walser 2016-10-19 21:54:11 CEST
Debian has issued an advisory for the issue fixed in 0.2.8.9 on October 18:
https://www.debian.org/security/2016/dsa-3694

URL: (none) => http://lwn.net/Vulnerabilities/703977/

Comment 8 David Walser 2016-10-19 23:39:18 CEST
(In reply to David Walser from comment #6)
> (In reply to David Walser from comment #5)
> > Tor 0.2.8.9 has been released on October 17:
> > https://blog.torproject.org/blog/tor-0289-released-important-fixes
> > 
> > It fixes another security issue.
> 
> CVE request:
> http://openwall.com/lists/oss-security/2016/10/18/11

CVE-2016-8860 has been assigned:
http://openwall.com/lists/oss-security/2016/10/19/11

Summary: tor 0.2.8.9 => tor 0.2.8.9 fixes CVE-2016-8860

Comment 9 Jani Välimaa 2016-10-20 16:39:43 CEST
Pushed 0.2.8.9 to Cauldron and mga5 core/updates_testing.

CC: (none) => jani.valimaa
CVE: (none) => CVE-2016-8860
Assignee: jani.valimaa => qa-bugs

Comment 10 David Walser 2016-10-20 16:56:42 CEST
Testing Procedure:
https://bugs.mageia.org/show_bug.cgi?id=3953#c4

Advisory:
========================

Updated tor package fixes security vulnerabilities:

It has been discovered that Tor treats the contents of some buffer chunks as if
they were a NUL-terminated string. This issue could enable a remote attacker to
crash a Tor client, hidden service, relay, or authority (CVE-2016-8860).

The tor package has been updated to version 0.2.8.9, which fixes this issue and
several other bugs, including other security issues fixed in 0.2.8.6.  See the
release announcements for details.

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8860
https://blog.torproject.org/blog/tor-0286-released
https://blog.torproject.org/blog/tor-0287-released-important-fixes
https://blog.torproject.org/blog/tor-0288-released-important-fixes
https://blog.torproject.org/blog/tor-0289-released-important-fixes
https://www.debian.org/security/2016/dsa-3694
========================

Updated packages in core/updates_testing:
========================
tor-0.2.8.9-1.mga5

from tor-0.2.8.9-1.mga5.src.rpm

Whiteboard: (none) => has_procedure

Comment 11 Lewis Smith 2016-10-24 17:12:32 CEST
Testing M5-64 real hardware; updated to tor-0.2.8.9-1.mga5.

And as a precaution, re-started the Tor daemon.

Configure Firefox to use Tor
---------------------------
 Preferences - Advanced - Connection, Configure:
  Check the 'Configure manually' radio button:
   In the bottom line headed SOCKS v5:
    enter 'localhost' (no quotes); Port 9050
   Check the 'SOCKS v5' radio button below
  Confirm OK the changes.
[To revert after testing, undo these changes]

Browsed to https://check.torproject.org/ , saw correctly the page:
"Congratulations. This browser is configured to use Tor.
 However, it does not appear to be Tor Browser."

This update OK.

CC: (none) => lewyssmith
Whiteboard: has_procedure => has_procedure MGA5-64-OK

Dave Hodgins 2016-10-25 22:42:41 CEST

Keywords: (none) => validated_update
Whiteboard: has_procedure MGA5-64-OK => has_procedure MGA5-64-OK advisory
CC: (none) => davidwhodgins, sysadmin-bugs

Comment 12 Mageia Robot 2016-10-26 01:12:20 CEST
An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2016-0356.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED