CVE-2011-4894
Last modified
CVE-2011-4894 is a vulnerability of currently unknown severity. Tor before 0.2.2.34, when configured as a bridge, uses direct DirPort access instead of a Tor TLS connection for a directory fetch, which makes it easier for remote attackers to enumerate bridges by observing DirPort connections.. EPSS estimates a 1.62% chance of exploitation in the next 30 days.
Description
Tor before 0.2.2.34, when configured as a bridge, uses direct DirPort access instead of a Tor TLS connection for a directory fetch, which makes it easier for remote attackers to enumerate bridges by observing DirPort connections.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Tor | Tor | <= 0.2.2.33 | — |
| Tor | Tor | 0.0.2 | — |
| Tor | Tor | 0.0.3 | — |
| Tor | Tor | 0.0.4 | — |
| Tor | Tor | 0.0.5 | — |
| Tor | Tor | 0.0.6 | — |
| Tor | Tor | 0.0.6.1 | — |
| Tor | Tor | 0.0.6.2 | — |
| Tor | Tor | 0.0.7 | — |
| Tor | Tor | 0.0.7.1 | — |
| Tor | Tor | 0.0.7.2 | — |
| Tor | Tor | 0.0.7.3 | — |
| Tor | Tor | 0.0.8 | — |
| Tor | Tor | 0.0.8.1 | — |
| Tor | Tor | 0.0.9 | — |
| Tor | Tor | 0.0.9.1 | — |
| Tor | Tor | 0.0.9.2 | — |
| Tor | Tor | 0.0.9.3 | — |
| Tor | Tor | 0.0.9.4 | — |
| Tor | Tor | 0.0.9.5 | — |
| Tor | Tor | 0.0.9.6 | — |
| Tor | Tor | 0.0.9.7 | — |
| Tor | Tor | 0.0.9.8 | — |
| Tor | Tor | 0.0.9.9 | — |
| Tor | Tor | 0.0.9.10 | — |
| Tor | Tor | 0.1.0.1 | — |
| Tor | Tor | 0.1.0.2 | — |
| Tor | Tor | 0.1.0.3 | — |
| Tor | Tor | 0.1.0.4 | — |
| Tor | Tor | 0.1.0.5 | — |
| Tor | Tor | 0.1.0.6 | — |
| Tor | Tor | 0.1.0.7 | — |
| Tor | Tor | 0.1.0.8 | — |
| Tor | Tor | 0.1.0.9 | — |
| Tor | Tor | 0.1.0.10 | — |
| Tor | Tor | 0.1.0.11 | — |
| Tor | Tor | 0.1.0.12 | — |
| Tor | Tor | 0.1.0.13 | — |
| Tor | Tor | 0.1.0.14 | — |
| Tor | Tor | 0.1.0.15 | — |
| Tor | Tor | 0.1.0.16 | — |
| Tor | Tor | 0.1.0.17 | — |
| Tor | Tor | 0.1.0.18 | — |
| Tor | Tor | 0.1.0.19 | — |
| Tor | Tor | 0.1.1 | — |
| Tor | Tor | 0.1.1.1 | — |
| Tor | Tor | 0.1.1.2 | — |
| Tor | Tor | 0.1.1.3 | — |
| Tor | Tor | 0.1.1.4 | — |
| Tor | Tor | 0.1.1.5 | — |
Showing 50 of 205 affected configurations. See NVD for the full list.
References
- https://blog.torproject.org/blog/tor-02234-released-security-patchesPatch, Vendor Advisory
- https://blog.torproject.org/blog/tor-02234-released-security-patchesPatch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2011-4894?
How severe is CVE-2011-4894?
How do I fix CVE-2011-4894?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2011
- CVE-2011-4887Cross-site scripting (XSS) vulnerability in the Violations T…
- CVE-2011-4889The javax.naming.directory.AttributeInUseException class in …
- CVE-2011-4890The server in IBM solidDB 6.5 before FP9 and 7.0 before FP1 …
- CVE-2011-4891Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2011-4892Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2011-4893Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2011-4895Tor before 0.2.2.34, when configured as a bridge, sets up ci…
- CVE-2011-4896Tor before 0.2.2.24-alpha continues to use a reachable bridg…
- CVE-2011-4897Tor before 0.2.2.25-alpha, when configured as a relay withou…
- CVE-2011-4898wp-admin/setup-config.php in the installation component in W…
- CVE-2011-4899wp-admin/setup-config.php in the installation component in W…
- CVE-2011-4900TYPO3 before 4.5.4 allows Information Disclosure in the back…6.5
Are you affected by CVE-2011-4894?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST