Some weaknesses and a vulnerability have been reported in Tor, which potentially can be exploited by malicious people to bypass certain security restrictions, disclose certain sensitive information, or potentially cause a DoS (Denial of Service).

1) An error in the handling of streamid's from different exits within a circuit can be exploited e.g. by a malicious Tor server within the circuit to inject arbitrary data into the TCP stream.

2) Sending destroy cells from a circuit's origin includes sending out a reason for tearing down the circuit. This weakens the Tor anonymity concept and may allow an attacker to narrow down users from a larger list.

3) An error in the handling of guard nodes can be exploited to aid in anonymity-related attacks.

4) A boundary error within the BSD natd support can be exploited to e.g. crash the application.

Successful exploitation requires that the Natdport configuration option is added to the torrc file on a BSD system.

The weaknesses and vulnerability are reported in versions prior to 0.1.2.15.

Solution
Update to version 0.1.2.15.
Further details available to Secunia VIM customers

Provided and/or discovered by
1-2) The vendor credits lodger.
3) Reported by the vendor.
4) The vendor credits croup.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://archives.seul.org/or/announce/Jul-2007/msg00000.html

Deep Links
Links available to Secunia VIM customers