Your message dated Thu, 07 Oct 2010 21:47:23 +0000
with message-id <[email protected]>
and subject line Bug#595375: fixed in torbutton 1.2.5-2
has caused the Debian Bug report #595375,
regarding xul-ext-torbutton: Leaks fingerprintable User-Agent when
extensions.torbutton.spoof_english = false
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
595375: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=595375
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: xul-ext-torbutton
Version: 1.2.5-1
Severity: important
Tags: security
Hi,
Context
=======
I am using the default preferences for the following settings:
pref("extensions.torbutton.set_uagent",true);
pref("extensions.torbutton.useragent_override", "Mozilla/5.0 (Windows; U;
Windows NT 6.1; LANG; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3");
What works
==========
extensions.torbutton.spoof_english defaults to true in
/usr/share/xul-ext/torbutton/defaults/preferences/preferences.js.
In this default case, the reported User-Agent is:
"Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.3) Gecko/20100401
Firefox/3.6.3"
i.e. the LANG placeholder is correctly replaced with a standard
looking locale in the torbutton_set_uagent() function.
What does not work
==================
When extensions.torbutton.spoof_english is set to true the reported
User-Agent is:
"Mozilla/5.0 (Windows; U; Windows NT 6.1;
chrome://global/locale/intl.properties; rv:1.9.2.3) Gecko/20100401
Firefox/3.6.3"
One can see the LANG placeholder is wrongly replaced with
"chrome://global/locale/intl.properties" instead of what is expected
i.e. the value of the "general.useragent.locale" preference setting.
Consequences
============
This leaks usage of Torbutton for userg who have disabled the
spoof_english setting. The Torbutton overridden User-Agent feature is
specifically aimed at preventing such fingerprinting. This bug makes
fingerprinting easier while the user thinks it has been made harder.
Hence the security tag and severity important.
Bye,
-- System Information:
Debian Release: squeeze/sid
APT prefers testing
APT policy: (900, 'testing')
Architecture: i386 (i686)
Kernel: Linux 2.6.32-5-686 (SMP w/1 CPU core)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
xul-ext-torbutton depends on no packages.
Versions of packages xul-ext-torbutton recommends:
ii iceweasel 3.5.11-1 Web browser based on Firefox
ii polipo 1.0.4.1-1.1~squeeze a small, caching web proxy
ii tor 0.2.1.26-1~squeeze+1 anonymizing overlay network for TC
xul-ext-torbutton suggests no packages.
-- no debconf information
--
intrigeri <[email protected]>
| GnuPG key @ https://gaffer.ptitcanardnoir.org/intrigeri/intrigeri.asc
| OTR fingerprint @
https://gaffer.ptitcanardnoir.org/intrigeri/otr-fingerprint.asc
| Who wants a world in which the guarantee that we shall not
| die of starvation would entail the risk of dying of boredom ?
--- End Message ---
--- Begin Message ---
Source: torbutton
Source-Version: 1.2.5-2
We believe that the bug you reported is fixed in the latest version of
torbutton, which is due to be installed in the Debian FTP archive:
iceweasel-torbutton_1.2.5-2_all.deb
to main/t/torbutton/iceweasel-torbutton_1.2.5-2_all.deb
torbutton_1.2.5-2.debian.tar.gz
to main/t/torbutton/torbutton_1.2.5-2.debian.tar.gz
torbutton_1.2.5-2.dsc
to main/t/torbutton/torbutton_1.2.5-2.dsc
xul-ext-torbutton_1.2.5-2_all.deb
to main/t/torbutton/xul-ext-torbutton_1.2.5-2_all.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Jérémy Bobbio <[email protected]> (supplier of updated torbutton package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Thu, 07 Oct 2010 23:23:37 +0200
Source: torbutton
Binary: xul-ext-torbutton iceweasel-torbutton
Architecture: source all
Version: 1.2.5-2
Distribution: unstable
Urgency: low
Maintainer: Jérémy Bobbio <[email protected]>
Changed-By: Jérémy Bobbio <[email protected]>
Description:
iceweasel-torbutton - transitional dummy package
xul-ext-torbutton - Iceweasel/Firefox extension enabling 1-click toggle of Tor
usage
Closes: 595375
Changes:
torbutton (1.2.5-2) unstable; urgency=low
.
[ Benjamin Drung ]
* Remove myself from Uploaders.
.
[ Jérémy Bobbio ]
* Add fix_broken_locale_useragent_string.patch: using Torbutton
with a localized user agent string on Debian resulted in a bad
and fingerprintable string. (Closes: #595375)
* Add fix_captcha_detection_for_encrypted_google.patch: fix captcha
detection for encrypted.google.com.
* Document a workaround for #571596 in README.Debian.
* Bump Standards-Version to 3.9.1, no changes required.
Checksums-Sha1:
c130bf4021de57ec642611318ca3542db107b442 1981 torbutton_1.2.5-2.dsc
591fad42713b3c0b1d39472b776b33b1c7d57754 7597 torbutton_1.2.5-2.debian.tar.gz
c31c5857a1ed2e07f3dd9e65daff78d5b567407d 275468
xul-ext-torbutton_1.2.5-2_all.deb
11d2c9adea2e40707f5bff3d4888cc875cecc7a0 12914
iceweasel-torbutton_1.2.5-2_all.deb
Checksums-Sha256:
76fe63f7a85f09cf68db1c2964e60f3c8018fab75f6d925b0e9160982a506455 1981
torbutton_1.2.5-2.dsc
0089ea539853e23ccccd650a08fa71dfbaee16100db8fd1cefb80e9e578d02fc 7597
torbutton_1.2.5-2.debian.tar.gz
0e406acef44ce1f24cfe8dcb3d2a4fd181f5516b3e061d4bd0795a8a503caa5a 275468
xul-ext-torbutton_1.2.5-2_all.deb
2ff8564a3120fe4655618c0f74407a53575da3c098ee868cd1ee0f8ab3b35d40 12914
iceweasel-torbutton_1.2.5-2_all.deb
Files:
95e95a2ecd767e04f796af7598bc5564 1981 web optional torbutton_1.2.5-2.dsc
f190ce185a6c272f1cf4411d48a068fb 7597 web optional
torbutton_1.2.5-2.debian.tar.gz
cc4047389188ea0fcb38c3da40f5c65d 275468 web optional
xul-ext-torbutton_1.2.5-2_all.deb
1f59068d795de29474991676936ab4ac 12914 web optional
iceweasel-torbutton_1.2.5-2_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iQIcBAEBCAAGBQJMrjshAAoJEEgU3sIrMHw8f6wP/3Dr+Drgk02lHRMpcQhX4QiS
9EQxSLH8fgtep5Z/B3Pq6gNCC6xFO/5sK/BS89c7w08o8aELN9bZUe47amFvt1pZ
UnVxyYmK8tCpLH1wR6Q1gInQYkr4pYU+tOyNyScEIpy54J4Rri17psd/dTr92zz7
U2U+E5kutHT6mLGMEsxNe8lPzM4ZQzzBq/Ez/klFD1tXY/U+09kB+18xx5y3OrMi
Blj4YIFOfYOWogMeh/+t/XQwuAv63Ttif+eBl8DcJ9BKUyltgcb/DKL1FnYj+Emq
IW69K97w+JexWO+nRHvEMZ2TIgkAvnzAGTQ6QsrBT2As1zN5AkGBXNSHo34VF65S
/IOlkhF8XQDW70NXR3wbbziDfSqXUZlAUY4a5+4090D1FW9h7jUYiCBaWfQPXQB4
pHLgr0NX7V5GfnQ+iAunys8ppPR9i90XBSNjE4h4msx102yT4Kj95pTMZZzIgCff
4qP6CNsO+l8ooDOHcUQZU5aLnEM852T6/7paYJ3TY61sR6VKmCB5irrhpKOByUDE
GIaCFswVHz7Aw3JYDTq1JHRfJLXe4dKKkvnBe1z+cYUwWVBGp+5K+iqVTLUxOpAf
StpJeQ0tI72UflqY/tUsRt/ZncrAABvDsBUGyPow4u07g0eNiZa5idtIlUQuTIu4
9lX8s5WmWfF8u31wwaFJ
=rk/5
-----END PGP SIGNATURE-----
--- End Message ---
_______________________________________________
tails-dev mailing list
[email protected]
https://boum.org/mailman/listinfo/tails-dev
