Read the docs
TI-2006-03312 Aliases CVE-2006-3414GHSA-8gg9-64gx-fjcc

Tor before 0.1.1.20 supports server descriptors that contain hostnames instead of IP…

Priority LOW 27Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · None · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Tor before 0.1.1.20 supports server descriptors that contain hostnames instead of IP addresses, which allows remote attackers to arbitrarily group users by providing preferential address resolution.

Why it matters now

EPSS 0.02153 82nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 68

CPEVersionsRoleVendor
cpe:2.3:a:tor:tor:0.0.2:*:*:*:*:*:*:*0.0.2VulnerableTor
cpe:2.3:a:tor:tor:0.0.2_pre13:*:*:*:*:*:*:*0.0.2_pre13VulnerableTor
cpe:2.3:a:tor:tor:0.0.2_pre14:*:*:*:*:*:*:*0.0.2_pre14VulnerableTor
cpe:2.3:a:tor:tor:0.0.2_pre15:*:*:*:*:*:*:*0.0.2_pre15VulnerableTor
cpe:2.3:a:tor:tor:0.0.2_pre16:*:*:*:*:*:*:*0.0.2_pre16VulnerableTor
cpe:2.3:a:tor:tor:0.0.2_pre17:*:*:*:*:*:*:*0.0.2_pre17VulnerableTor
cpe:2.3:a:tor:tor:0.0.2_pre18:*:*:*:*:*:*:*0.0.2_pre18VulnerableTor
cpe:2.3:a:tor:tor:0.0.2_pre19:*:*:*:*:*:*:*0.0.2_pre19VulnerableTor
cpe:2.3:a:tor:tor:0.0.2_pre20:*:*:*:*:*:*:*0.0.2_pre20VulnerableTor
cpe:2.3:a:tor:tor:0.0.2_pre21:*:*:*:*:*:*:*0.0.2_pre21VulnerableTor
  • cpe:2.3:a:tor:tor:0.0.2:*:*:*:*:*:*:* Versions 0.0.2 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.2_pre13:*:*:*:*:*:*:* Versions 0.0.2_pre13 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.2_pre14:*:*:*:*:*:*:* Versions 0.0.2_pre14 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.2_pre15:*:*:*:*:*:*:* Versions 0.0.2_pre15 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.2_pre16:*:*:*:*:*:*:* Versions 0.0.2_pre16 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.2_pre17:*:*:*:*:*:*:* Versions 0.0.2_pre17 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.2_pre18:*:*:*:*:*:*:* Versions 0.0.2_pre18 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.2_pre19:*:*:*:*:*:*:* Versions 0.0.2_pre19 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.2_pre20:*:*:*:*:*:*:* Versions 0.0.2_pre20 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.2_pre21:*:*:*:*:*:*:* Versions 0.0.2_pre21 Vulnerable ·Tor
Show 58 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:tor:tor:0.0.2_pre22:*:*:*:*:*:*:*0.0.2_pre22VulnerableTor
cpe:2.3:a:tor:tor:0.0.2_pre23:*:*:*:*:*:*:*0.0.2_pre23VulnerableTor
cpe:2.3:a:tor:tor:0.0.2_pre24:*:*:*:*:*:*:*0.0.2_pre24VulnerableTor
cpe:2.3:a:tor:tor:0.0.2_pre25:*:*:*:*:*:*:*0.0.2_pre25VulnerableTor
cpe:2.3:a:tor:tor:0.0.2_pre26:*:*:*:*:*:*:*0.0.2_pre26VulnerableTor
cpe:2.3:a:tor:tor:0.0.2_pre27:*:*:*:*:*:*:*0.0.2_pre27VulnerableTor
cpe:2.3:a:tor:tor:0.0.3:*:*:*:*:*:*:*0.0.3VulnerableTor
cpe:2.3:a:tor:tor:0.0.4:*:*:*:*:*:*:*0.0.4VulnerableTor
cpe:2.3:a:tor:tor:0.0.5:*:*:*:*:*:*:*0.0.5VulnerableTor
cpe:2.3:a:tor:tor:0.0.6:*:*:*:*:*:*:*0.0.6VulnerableTor
cpe:2.3:a:tor:tor:0.0.6.1:*:*:*:*:*:*:*0.0.6.1VulnerableTor
cpe:2.3:a:tor:tor:0.0.6.2:*:*:*:*:*:*:*0.0.6.2VulnerableTor
cpe:2.3:a:tor:tor:0.0.7:*:*:*:*:*:*:*0.0.7VulnerableTor
cpe:2.3:a:tor:tor:0.0.7.1:*:*:*:*:*:*:*0.0.7.1VulnerableTor
cpe:2.3:a:tor:tor:0.0.7.2:*:*:*:*:*:*:*0.0.7.2VulnerableTor
cpe:2.3:a:tor:tor:0.0.7.3:*:*:*:*:*:*:*0.0.7.3VulnerableTor
cpe:2.3:a:tor:tor:0.0.8:*:*:*:*:*:*:*0.0.8VulnerableTor
cpe:2.3:a:tor:tor:0.0.8.1:*:*:*:*:*:*:*0.0.8.1VulnerableTor
cpe:2.3:a:tor:tor:0.0.9:*:*:*:*:*:*:*0.0.9VulnerableTor
cpe:2.3:a:tor:tor:0.0.9.1:*:*:*:*:*:*:*0.0.9.1VulnerableTor
cpe:2.3:a:tor:tor:0.0.9.2:*:*:*:*:*:*:*0.0.9.2VulnerableTor
cpe:2.3:a:tor:tor:0.0.9.3:*:*:*:*:*:*:*0.0.9.3VulnerableTor
cpe:2.3:a:tor:tor:0.0.9.4:*:*:*:*:*:*:*0.0.9.4VulnerableTor
cpe:2.3:a:tor:tor:0.0.9.5:*:*:*:*:*:*:*0.0.9.5VulnerableTor
cpe:2.3:a:tor:tor:0.0.9.6:*:*:*:*:*:*:*0.0.9.6VulnerableTor
cpe:2.3:a:tor:tor:0.0.9.7:*:*:*:*:*:*:*0.0.9.7VulnerableTor
cpe:2.3:a:tor:tor:0.0.9.8:*:*:*:*:*:*:*0.0.9.8VulnerableTor
cpe:2.3:a:tor:tor:0.0.9.9:*:*:*:*:*:*:*0.0.9.9VulnerableTor
cpe:2.3:a:tor:tor:0.0.9.10:*:*:*:*:*:*:*0.0.9.10VulnerableTor
cpe:2.3:a:tor:tor:0.1.0.1:*:*:*:*:*:*:*0.1.0.1VulnerableTor
cpe:2.3:a:tor:tor:0.1.0.2:*:*:*:*:*:*:*0.1.0.2VulnerableTor
cpe:2.3:a:tor:tor:0.1.0.3:*:*:*:*:*:*:*0.1.0.3VulnerableTor
cpe:2.3:a:tor:tor:0.1.0.4:*:*:*:*:*:*:*0.1.0.4VulnerableTor
cpe:2.3:a:tor:tor:0.1.0.5:*:*:*:*:*:*:*0.1.0.5VulnerableTor
cpe:2.3:a:tor:tor:0.1.0.6:*:*:*:*:*:*:*0.1.0.6VulnerableTor
cpe:2.3:a:tor:tor:0.1.0.7:*:*:*:*:*:*:*0.1.0.7VulnerableTor
cpe:2.3:a:tor:tor:0.1.0.8:*:*:*:*:*:*:*0.1.0.8VulnerableTor
cpe:2.3:a:tor:tor:0.1.0.9:*:*:*:*:*:*:*0.1.0.9VulnerableTor
cpe:2.3:a:tor:tor:0.1.0.10:*:*:*:*:*:*:*0.1.0.10VulnerableTor
cpe:2.3:a:tor:tor:0.1.0.11:*:*:*:*:*:*:*0.1.0.11VulnerableTor
cpe:2.3:a:tor:tor:0.1.0.12:*:*:*:*:*:*:*0.1.0.12VulnerableTor
cpe:2.3:a:tor:tor:0.1.0.13:*:*:*:*:*:*:*0.1.0.13VulnerableTor
cpe:2.3:a:tor:tor:0.1.0.14:*:*:*:*:*:*:*0.1.0.14VulnerableTor
cpe:2.3:a:tor:tor:0.1.0.15:*:*:*:*:*:*:*0.1.0.15VulnerableTor
cpe:2.3:a:tor:tor:0.1.0.16:*:*:*:*:*:*:*0.1.0.16VulnerableTor
cpe:2.3:a:tor:tor:0.1.0.17:*:*:*:*:*:*:*0.1.0.17VulnerableTor
cpe:2.3:a:tor:tor:0.1.0.18:*:*:*:*:*:*:*0.1.0.18VulnerableTor
cpe:2.3:a:tor:tor:0.1.0.19:*:*:*:*:*:*:*0.1.0.19VulnerableTor
cpe:2.3:a:tor:tor:0.1.1.1_alpha:*:*:*:*:*:*:*0.1.1.1_alphaVulnerableTor
cpe:2.3:a:tor:tor:0.1.1.2_alpha:*:*:*:*:*:*:*0.1.1.2_alphaVulnerableTor
cpe:2.3:a:tor:tor:0.1.1.3_alpha:*:*:*:*:*:*:*0.1.1.3_alphaVulnerableTor
cpe:2.3:a:tor:tor:0.1.1.4_alpha:*:*:*:*:*:*:*0.1.1.4_alphaVulnerableTor
cpe:2.3:a:tor:tor:0.1.1.5_alpha:*:*:*:*:*:*:*0.1.1.5_alphaVulnerableTor
cpe:2.3:a:tor:tor:0.1.1.6_alpha:*:*:*:*:*:*:*0.1.1.6_alphaVulnerableTor
cpe:2.3:a:tor:tor:0.1.1.7_alpha:*:*:*:*:*:*:*0.1.1.7_alphaVulnerableTor
cpe:2.3:a:tor:tor:0.1.1.8_alpha:*:*:*:*:*:*:*0.1.1.8_alphaVulnerableTor
cpe:2.3:a:tor:tor:0.1.1.9_alpha:*:*:*:*:*:*:*0.1.1.9_alphaVulnerableTor
cpe:2.3:a:tor:tor:0.1.1.10_alpha:*:*:*:*:*:*:*0.1.1.10_alphaVulnerableTor
  • cpe:2.3:a:tor:tor:0.0.2_pre22:*:*:*:*:*:*:* Versions 0.0.2_pre22 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.2_pre23:*:*:*:*:*:*:* Versions 0.0.2_pre23 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.2_pre24:*:*:*:*:*:*:* Versions 0.0.2_pre24 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.2_pre25:*:*:*:*:*:*:* Versions 0.0.2_pre25 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.2_pre26:*:*:*:*:*:*:* Versions 0.0.2_pre26 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.2_pre27:*:*:*:*:*:*:* Versions 0.0.2_pre27 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.3:*:*:*:*:*:*:* Versions 0.0.3 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.4:*:*:*:*:*:*:* Versions 0.0.4 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.5:*:*:*:*:*:*:* Versions 0.0.5 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.6:*:*:*:*:*:*:* Versions 0.0.6 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.6.1:*:*:*:*:*:*:* Versions 0.0.6.1 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.6.2:*:*:*:*:*:*:* Versions 0.0.6.2 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.7:*:*:*:*:*:*:* Versions 0.0.7 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.7.1:*:*:*:*:*:*:* Versions 0.0.7.1 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.7.2:*:*:*:*:*:*:* Versions 0.0.7.2 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.7.3:*:*:*:*:*:*:* Versions 0.0.7.3 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.8:*:*:*:*:*:*:* Versions 0.0.8 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.8.1:*:*:*:*:*:*:* Versions 0.0.8.1 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.9:*:*:*:*:*:*:* Versions 0.0.9 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.9.1:*:*:*:*:*:*:* Versions 0.0.9.1 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.9.2:*:*:*:*:*:*:* Versions 0.0.9.2 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.9.3:*:*:*:*:*:*:* Versions 0.0.9.3 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.9.4:*:*:*:*:*:*:* Versions 0.0.9.4 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.9.5:*:*:*:*:*:*:* Versions 0.0.9.5 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.9.6:*:*:*:*:*:*:* Versions 0.0.9.6 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.9.7:*:*:*:*:*:*:* Versions 0.0.9.7 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.9.8:*:*:*:*:*:*:* Versions 0.0.9.8 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.9.9:*:*:*:*:*:*:* Versions 0.0.9.9 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.0.9.10:*:*:*:*:*:*:* Versions 0.0.9.10 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.0.1:*:*:*:*:*:*:* Versions 0.1.0.1 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.0.2:*:*:*:*:*:*:* Versions 0.1.0.2 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.0.3:*:*:*:*:*:*:* Versions 0.1.0.3 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.0.4:*:*:*:*:*:*:* Versions 0.1.0.4 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.0.5:*:*:*:*:*:*:* Versions 0.1.0.5 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.0.6:*:*:*:*:*:*:* Versions 0.1.0.6 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.0.7:*:*:*:*:*:*:* Versions 0.1.0.7 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.0.8:*:*:*:*:*:*:* Versions 0.1.0.8 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.0.9:*:*:*:*:*:*:* Versions 0.1.0.9 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.0.10:*:*:*:*:*:*:* Versions 0.1.0.10 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.0.11:*:*:*:*:*:*:* Versions 0.1.0.11 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.0.12:*:*:*:*:*:*:* Versions 0.1.0.12 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.0.13:*:*:*:*:*:*:* Versions 0.1.0.13 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.0.14:*:*:*:*:*:*:* Versions 0.1.0.14 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.0.15:*:*:*:*:*:*:* Versions 0.1.0.15 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.0.16:*:*:*:*:*:*:* Versions 0.1.0.16 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.0.17:*:*:*:*:*:*:* Versions 0.1.0.17 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.0.18:*:*:*:*:*:*:* Versions 0.1.0.18 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.0.19:*:*:*:*:*:*:* Versions 0.1.0.19 Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.1.1_alpha:*:*:*:*:*:*:* Versions 0.1.1.1_alpha Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.1.2_alpha:*:*:*:*:*:*:* Versions 0.1.1.2_alpha Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.1.3_alpha:*:*:*:*:*:*:* Versions 0.1.1.3_alpha Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.1.4_alpha:*:*:*:*:*:*:* Versions 0.1.1.4_alpha Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.1.5_alpha:*:*:*:*:*:*:* Versions 0.1.1.5_alpha Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.1.6_alpha:*:*:*:*:*:*:* Versions 0.1.1.6_alpha Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.1.7_alpha:*:*:*:*:*:*:* Versions 0.1.1.7_alpha Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.1.8_alpha:*:*:*:*:*:*:* Versions 0.1.1.8_alpha Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.1.9_alpha:*:*:*:*:*:*:* Versions 0.1.1.9_alpha Vulnerable ·Tor
  • cpe:2.3:a:tor:tor:0.1.1.10_alpha:*:*:*:*:*:*:* Versions 0.1.1.10_alpha Vulnerable ·Tor

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2006-3414
  2. 2026-10-03 Alias added: GHSA-8gg9-64gx-fjcc

References

Advisory 1

Other 2

  • TI-2010-01618 Heap-based buffer overflow in Tor before 0.2.1.28 and 0.2.2.x before 0.2.2.20-alpha… CVSS 2.0HIGH 10.0
  • TI-2009-00394 Unspecified vulnerability in Tor before 0.2.0.33 has unspecified impact and remote attack… CVSS 2.0HIGH 10.0
  • TI-2009-00893 Tor before 0.2.0.34 treats incomplete IPv4 addresses as valid, which has unknown impact… CVSS 2.0HIGH 10.0
  • TI-2008-05138 Tor before 0.2.0.32 does not properly process the ClientDNSRejectInternalAddresses… CVSS 2.0HIGH 9.3
  • TI-2011-02436 Multiple heap-based buffer overflows in Tor before 0.2.2.35 allow remote attackers to… CVSS 2.0HIGH 7.6
  • TI-2006-03307 Integer overflow in Tor before 0.1.1.20 allows remote attackers to execute arbitrary code… CVSS 2.0HIGH 7.5
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences