Vulnerability in Tor
CVE-2006-3419
Tor before 0.1.1.20 uses OpenSSL pseudo-random bytes (RAND_pseudo_bytes) instead of cryptographically strong RAND_bytes, and seeds the entropy value at start-up with 160-bit chunks without reseeding, which makes it easier for attackers to conduct brute force guessing attacks.
EPSS: 0.016 (73.7th percentile) — read the EPSS interpretation.
Affected products
- Tor — versions 0.0.2, 0.0.2_pre13, 0.0.2_pre14
- N/a — versions n/a
Public proof-of-concept exploits
References
- cve@mitre.org (x_refsource_OSVDB, vdb-entry)
- cve@mitre.org (Patch, x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (vendor-advisory, x_refsource_GENTOO)
- cve@mitre.org (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2006-3419?
- CVE-2006-3419 is a vulnerability in Tor. Published 2006-07-07.
- Is CVE-2006-3419 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.