Thema: Neue Tor-Version: sicherer und anonymer

[SiLæncer]

What's new: >>

    the option "Allow invalid certification authorities from certificates for bridges.torproject.org" was removed; on error, a message box will ask if the download should be retried ignoring unrecognized CA's
    the options TunnelDirConns (BOOL) and PreferTunneledDirConns (BOOL) were merged as TunnelDirConns (UINT)
    all procedures that handle proxy requests for OR and directory connections were moved to connection_proxy.c
    the options HttpsProxy, HttpsProxyAuthenticator, Socks4Proxy, Socks5Proxy, Socks5ProxyUsername and Socks5ProxyPassword were merged as ORProxy, ORProxyAuthenticator and ORProxyProtocol (supported protocols: HTTPS, Socks4 and Socks5)
    added support for HTTPS, Socks4 and Socks5 proxies for HTTP directory connections
    the options HttpProxy and HttpProxyAuthenticator were replaced with DirProxy, DirProxyAuthenticator and DirProxyProtocol (supported protocols: HTTP, HTTPS, Socks4 and Socks5)
    updated language strings: 656, 2540, 2541, 2542, 2875, 2991, 2992, 2993, 2994, 2995, 2996, 2998, 3031, 3190
    the instructions for making a "Tor browser" with Firefox and the AdvOR.ini sample for Firefox were updated to work with the latest "Tor Browser" package from torproject.org (tor-browser-2.2.34-3_en-US.exe)
    geoip_c.h was updated with GeoIPCountryWhois.csv released on December 7th

http://sourceforge.net/projects/advtor/

[SiLæncer]

What's new: >>

    corrected: buffer overflow when repacking the first chunk of a buf_t buffer (bugfix for AdvOR and Tor, all versions)

http://sourceforge.net/projects/advtor/

[SiLæncer]

What's new: >>

    corrected: when the option to reject .exitname.exit hostnames was enabled, addresses that were mapped to exit nodes were also rejected (thanks to DavidWakelin for reporting this problem)
    when the circuit path length is set to 1, the option "Do not use the public key step for the entry node" will be disabled
    new configuration options: CorporateProxy, CorporateProxyDomain, CorporateProxyAuthenticator and CorporateProxyProtocol (supported protocols: NTLM)
    added support for NTLM proxies (libntlm 1.3)
    new options on the "Bypass ISP filtering" page: "Always use this NTLM proxy" (CorporateProxy, CorporateProxyProtocol), "workstation@domain" (CorporateProxyDomain), "Account (username:password)" (CorporateProxyAuthenticator)
    the NTLM proxy can be chained with ORProxy and/or DirProxy if needed; when enabled, the NTLM proxy is always the first proxy of a proxy chain
    updated language strings: 3191, 3192, 3193, 3194, 3195, 3196, 3197, 3198, 3199, 3200

http://sourceforge.net/projects/advtor/

[SiLæncer]

Mit der Alpha-Version 0.2.3.9 der Anonymisierungssoftware Tor können sich Tor-Clients erstmals per IPv6 zu Tor-Bridges verbinden. Laut der Ankündigung im Tor-Blog brauchen die als Bridge arbeitenden Tor-Knoten allerdings weiterhin mindestens eine IPv4-Adresse, da sie ansonsten den Kontakt zu anderen Knoten im Tor-Netz verlieren würden. Wie man die für den IPv6-Betrieb nötigen Optionen auf einer Tor-Bridge richtig setzt, beschreibt Linus Nordberg im Tor-Entwickler-Forum.

Zusätzlich haben die Tor-Entwickler die Konfigurationsoption "DisableNetwork" und einen per Vorgabe ausgeschalteten Tor2Web-Mode hinzugefügt, über den sich Clients nicht-anonym zu versteckten Tor-Diensten verbinden können. Ist "DisableNetwork" eingeschaltet, baut ein installierter Tor-Dienst beim Start keine Netzwerkverbindungen auf und akzeptiert auch keine eingehenden (außer am Control-Port). Steuert man das Anonymisierungsnetz etwa über Orbot (Tor-Implementierung für Android) kann man auf diese Weise Strom sparen. Weitere Details zu den neuen Funktionen finden sich im Tor-Blog und im Entwickler-Forum .

Quelle : www.heise.de

[SiLæncer]

Whats new: >>

- [tor-0.2.2.35] (this change was not applied because AdvOR already had a better fix since 0.3.0.4b) Fix a heap overflow bug that could occur when trying to pull data into the first chunk of a buffer, when that chunk had already had some data drained from it. Fixes CVE-2011-2778; bugfix on 0.2.0.16-alpha. Reported by "Vektor".
- [tor-0.2.2.35] Initialize Libevent with the EVENT_BASE_FLAG_NOLOCK flag enabled, so that it doesn't attempt to allocate a socketpair. This could cause some problems on Windows systems with overzealous firewalls. Fix for bug 4457; workaround for Libevent versions 2.0.1-alpha through 2.0.15-stable.
- [tor-0.2.2.35] If we mark an OR connection for close based on a cell we process, don't process any further cells on it. We already avoid further reads on marked-for-close connections, but now we also discard the cells we'd already read. Fixes bug 4299; bugfix on 0.2.0.10-alpha, which was the first version where we might mark a connection for close based on processing a cell on it.
- [tor-0.2.2.35] Correctly sanity-check that we don't underflow on a memory allocation (and then assert) for hidden service introduction point decryption. Bug discovered by Dan Rosenberg. Fixes bug 4410; bugfix on 0.2.1.5-alpha.
- [tor-0.2.2.35] Fix a memory leak when we check whether a hidden service descriptor has any usable introduction points left. Fixes bug 4424. Bugfix on 0.2.2.25-alpha.
- [tor-0.2.2.35] Detect failure to initialize Libevent. This fix provides better detection for future instances of bug 4457.
- [tor-0.2.2.35] Avoid frequent calls to the fairly expensive cull_wedged_cpuworkers function. This was eating up hideously large amounts of time on some busy servers. Fixes bug 4518; bugfix on 0.0.9.8.
- [tor-0.2.2.35] Resolve an integer overflow bug in smartlist_ensure_capacity(). Fixes bug 4230; bugfix on Tor 0.1.0.1-rc. Based on a patch by Mansour Moufid.
- [tor-0.2.2.35] When configuring, starting, or stopping an NT service, stop immediately after the service configuration attempt has succeeded or failed. Fixes bug 3963; bugfix on 0.2.0.7-alpha.
- [tor-0.2.2.35] When sending a NETINFO cell, include the original address received for the other side, not its canonical address. Found by "troll_un"; fixes bug 4349; bugfix on 0.2.0.10-alpha.
- [tor-0.2.2.35] Fix a memory leak in launch_direct_bridge_descriptor_fetch() that occurred when a client tried to fetch a descriptor for a bridge in ExcludeNodes. Fixes bug 4383; bugfix on 0.2.2.25-alpha.
- [tor-0.2.2.35] If we had ever tried to call tor_addr_to_str on an address of unknown type, we would have done a strdup on an uninitialized buffer. Now we won't. Fixes bug 4529; bugfix on 0.2.1.3-alpha. Reported by "troll_un".
- [tor-0.2.2.35] Correctly detect and handle transient lookup failures from tor_addr_lookup. Fixes bug 4530; bugfix on 0.2.1.5-alpha. Reported by "troll_un".
- [tor-0.2.2.35] Fix null-pointer access that could occur if TLS allocation failed. Fixes bug 4531; bugfix on 0.2.0.20-rc. Found by "troll_un".
- [tor-0.2.2.35] Use tor_socket_t type for listener argument to accept(). Fixes bug 4535; bugfix on 0.2.2.28-beta. Found by "troll_un".
- [tor-0.2.2.35] Add two new config options for directory authorities: AuthDirFastGuarantee sets a bandwidth threshold for guaranteeing the Fast flag, and AuthDirGuardBWGuarantee sets a bandwidth threshold that is always sufficient to satisfy the bandwidth requirement for the Guard flag. Now it will be easier for researchers to simulate Tor networks with different values. Resolves ticket 4484.
- corrected: the OR port was set while initializing keys (thanks to DavidWakelin for reporting this error)
- updated language strings: 3201, 3202

http://sourceforge.net/projects/advtor/

[SiLæncer]

Tor Browser Bundle (2.2.35-1)

    Update Tor to 0.2.2.35
    Update NoScript to 2.2.3
    Update Torbutton to 1.4.5
    New Firefox patches
        Disable SSL Session ID tracking
        Provide an observer event to close persistent connections

https://www.torproject.org/

[SiLæncer]

Changes:

    corrected a change from version 0.3.0.6 in tor_addr_port_parse() that caused it to return errors when parsing proxy IP addresses (thanks to anonymous11 for reporting this error)
    improved the search algorithm for addresses that are added to the context menus related to strings selected in the "Debug" window
    all router selection dialogs will show bandwidth capacities instead of bandwidth rates for routers that are not banned
    the lists with favorite routers and with banned routers are no longer limited to 65536 characters
    added instructions for using TorChat with AdvOR and configuration samples to AdvOR\Help\TorChat (readme.txt, AdvOR.ini and torrc.txt)


http://sourceforge.net/projects/advtor/

[SiLæncer]

Tor Browser Bundle (2.2.35-3)

    Update Firefox to 9.0.1

Tor Browser Bundle (2.2.35-2)

    Update Firefox to 9.0
    Update Torbutton to 1.4.5.1
    Update Noscript to 2.2.4
    New Firefox patches
        Provide client values only to CSS Media Queries and disable several Mozilla extensions that seem fingerprintable

https://www.torproject.org/

[SiLæncer]

The Tor Browser Bundles and other packages have been updated to OpenSSL 1.0.0f and 0.9.8s. All users are encouraged to update.

Tor Browser Bundle (2.2.35-4)

    Update OpenSSL to 1.0.0f
    Update NoScript to 2.2.5


https://www.torproject.org/

[SiLæncer]

Tor Browser Bundle (2.2.35-5)

    Update Firefox to 10.0
    Update Qt to 4.7.4
    Update OpenSSL to 1.0.0g
    Update zlib to 1.2.6
    Update HTTPS Everywhere to 1.2.2
    Update NoScript to 2.2.8
    New Firefox patches
        Limit the number of fonts per document

Linux changes

    Put documentation in remove-shared-lib-symlinks debug dumps (closes: #4984)

Windows changes

    Make sure mozconfig always gets copied into the Firefox build directory
    (closes: #4879)

https://www.torproject.org/

[SiLæncer]

Tor Browser Bundle (2.2.35-6)

    Update Firefox to 10.0.1
    Update Vidalia to 0.2.17
    Update Libevent to 2.0.17-stable
    Update NoScript to 2.3

https://www.torproject.org/

[SiLæncer]

The Tor Browser Bundles have all been updated to the latest Firefox 10.0.2.

https://www.torproject.org/download

Tor Browser Bundle (2.2.35-7)

    Update Firefox to 10.0.2

Linux updates

    Update libpng to 1.5.8 (closes: #5144)

[SiLæncer]

The wrong version of Firefox got into the OS X 64-bit and Windows bundles. These have now been updated properly and are online with version number 2.2.35-7.1.

https://www.torproject.org/

[SiLæncer]

2012-02-20 Advanced Onion Router 0.3.0.7a

- corrected: timeradd() and timersub() used wrong operands for updating microseconds (bugfix for AdvOR and Tor, all versions)
- corrected: buffer overflow when loading language files for plugins (thanks to Re4 for reporting this error and for sharing test language files that helped reproducing this error)
- geoip_c.h was updated with GeoIPCountryWhois.csv released on February 2nd

http://sourceforge.net/projects/advtor/

[SiLæncer]

Tor Browser Bundle (2.2.35-8)

    Update Firefox to 11.0
    Update OpenSSL to 1.0.0h
    Update NoScript to 2.3.4
    Update HTTPS Everywhere to 2.0.1
    Always build to with warnings enabled (closes: #4470)
    Disable HTTPS Everywhere SSL Observatory screen (closes: #5300)

Windows

    Remove tor-resolve from the Windows bundle (closes: #5403)

Mac OS X

Give OS X users below 10.5 an incompatibility message (closes: #4356)

Linux

    Don't attempt to load the default KDE 4 theme from Vidalia, because that fails when the Qt versions don't match (closes: #5214)