Lucene search

MitreCVE-2007-4174

HistoryAug 07, 2007 - 10:17 a.m.

CVE-2007-4174

2007-08-0710:17:00

CWE-264

mitre

web.nvd.nist.gov

cve-2007-4174

tor

controlport

remote attack

command execution

security vulnerability

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

AI Score

6.6

Confidence

Low

EPSS

0.019

Percentile

88.6%

JSON

Tor before 0.1.2.16, when ControlPort is enabled, does not properly restrict commands to localhost port 9051, which allows remote attackers to modify the torrc configuration file, compromise anonymity, and have other unspecified impact via HTTP POST data containing commands without valid authentication, as demonstrated by an HTML form (1) hosted on a web site or (2) injected by a Tor exit node.

Affected configurations

Nvd

Node

tortorRange≤0.1.2.15

tortorMatch0.1.2.1alpha

tortorMatch0.1.2.2

tortorMatch0.1.2.3alpha

tortorMatch0.1.2.4

tortorMatch0.1.2.5

tortorMatch0.1.2.5alpha

tortorMatch0.1.2.6alpha

tortorMatch0.1.2.7alpha

tortorMatch0.1.2.8beta

tortorMatch0.1.2.9

tortorMatch0.1.2.10

tortorMatch0.1.2.11

tortorMatch0.1.2.12

tortorMatch0.1.2.13

tortorMatch0.1.2.14

VendorProductVersionCPE
tortor*cpe:2.3:a:tor:tor:*:*:*:*:*:*:*:*
tortor0.1.2.1cpe:2.3:a:tor:tor:0.1.2.1:alpha:*:*:*:*:*:*
tortor0.1.2.2cpe:2.3:a:tor:tor:0.1.2.2:*:*:*:*:*:*:*
tortor0.1.2.3cpe:2.3:a:tor:tor:0.1.2.3:alpha:*:*:*:*:*:*
tortor0.1.2.4cpe:2.3:a:tor:tor:0.1.2.4:*:*:*:*:*:*:*
tortor0.1.2.5cpe:2.3:a:tor:tor:0.1.2.5:*:*:*:*:*:*:*
tortor0.1.2.5cpe:2.3:a:tor:tor:0.1.2.5:alpha:*:*:*:*:*:*
tortor0.1.2.6cpe:2.3:a:tor:tor:0.1.2.6:alpha:*:*:*:*:*:*
tortor0.1.2.7cpe:2.3:a:tor:tor:0.1.2.7:alpha:*:*:*:*:*:*
tortor0.1.2.8cpe:2.3:a:tor:tor:0.1.2.8:beta:*:*:*:*:*:*

Vendor	Product	Version	CPE
tor	tor	*	cpe:2.3:a:tor:tor::::::::
tor	tor	0.1.2.1	cpe:2.3:a:tor:tor:0.1.2.1:alpha::::::
tor	tor	0.1.2.2	cpe:2.3:a:tor:tor:0.1.2.2:::::::*
tor	tor	0.1.2.3	cpe:2.3:a:tor:tor:0.1.2.3:alpha::::::
tor	tor	0.1.2.4	cpe:2.3:a:tor:tor:0.1.2.4:::::::*
tor	tor	0.1.2.5	cpe:2.3:a:tor:tor:0.1.2.5:::::::*
tor	tor	0.1.2.5	cpe:2.3:a:tor:tor:0.1.2.5:alpha::::::
tor	tor	0.1.2.6	cpe:2.3:a:tor:tor:0.1.2.6:alpha::::::
tor	tor	0.1.2.7	cpe:2.3:a:tor:tor:0.1.2.7:alpha::::::
tor	tor	0.1.2.8	cpe:2.3:a:tor:tor:0.1.2.8:beta::::::