CVE-2018-25022

The Onion module in toxcore before 0.2.2 doesn't restrict which packets can be onion-routed, which allows a remote attacker to discover a target user's IP address (when knowing only their Tox Id) by positioning themselves close to target's Tox Id in the DHT for the target to establish an onion connection with the attacker, guessing the target's DHT public key and creating a DHT node with public key close to it, and finally onion-routing a NAT Ping Request to the target, requesting it to ping the just created DHT node.

References

Affected packages

Git / github.com/toktok/c-toxcore

Affected ranges

Type: GIT
Repo: https://github.com/toktok/c-toxcore
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

2824daf74a6d2bd60ebaf387a30f1b7719b6b67c

Affected versions

v0.*

v0.0.0

v0.0.1

v0.0.2

v0.0.3

v0.0.4

v0.0.5

v0.1.0

v0.1.1

v0.1.10

v0.1.11

v0.1.2

v0.1.3

v0.1.4

v0.1.5

v0.1.6

v0.1.7

v0.1.8

v0.1.9

v0.2.0

v0.2.1

Database specific

vanir_signatures

[
    {
        "source": "https://github.com/toktok/c-toxcore/commit/2824daf74a6d2bd60ebaf387a30f1b7719b6b67c",
        "id": "CVE-2018-25022-d80d1913",
        "deprecated": false,
        "signature_version": "v1",
        "target": {
            "file": "toxcore/tox.api.h"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "135803685644179650833532485558842401645",
                "249099949619565161365737240271747862094",
                "281542610782194053571261712578238241703",
                "334750808225221794425081905088948868473"
            ]
        },
        "signature_type": "Line"
    }
]