1

while browsing a website using tor i got the error as shown in image.

tor error

I was shocked because error shows my name and path in my system.

Is the above error something to be worried about or is it just a client side error which does not compromise my identity?

Iam using tor-browser bundle on windows 10 pc downloaded from https://www.torproject.org/download/download

EDIT:

This is a mozilla firefox bug reported 1 year ago here. But iam using latest updated tor. How this bug can affect me?

Improve this question
7
  • It's hardly a client-side error. If it's not your hidden service - then you should check your PC, it may be compromised(because it shows your username and your actual path). Please specify what is your exact setup? maybe I'll be able to help you a bit more with details
    – Alexey Vesnin ♦
    Commented Oct 18, 2016 at 19:15
  • i have tor-browser bundle on win 10 pc.(the one in which firefox is provided by tor itself). My pc may not be compromised bcoz 2 days before i clean installed win 10.
    – optimus prime
    Commented Oct 18, 2016 at 20:18
  • Weird, because I am using it on Windows 10 too and haven't had any problems with it so far. What antivirus software do you have?
    – Alexey Vesnin ♦
    Commented Oct 18, 2016 at 20:20
  • i have avast premier.
    – optimus prime
    Commented Oct 18, 2016 at 20:22
  • 1
    that's the point - TorBrowser is based on long-term FF, not the very current, of course - but not on so old too. Do you run your browser from separate non-admin user or from admin user?
    – Alexey Vesnin ♦
    Commented Oct 18, 2016 at 20:47

1 Answer 1

Reset to default
1

It's b0rking when trying to report a network error to you. It's happening while expanding entities (&netInterrupt.longDesc; denotes an "entity") within the XML document template that it uses to generate the page displaying the network error it encountered. This is a long standing Firefox bug, on the Mozilla tracker it is Bug 569229, and on the Tor Project tracker it is #8842.

From the Mozilla bugtracker:

This is triggered by nested entities. Expat keeps a linked list of open entities (openInternalEntities) which goes from the most inner open entity to the most outer open entity. In this case we're parsing an entity and it ends in another (inner) entity. While parsing that inner entity we block the parser, either because we're loading something like script, or because we interrupt. The inner entity hasn't been completely parsed, so it's not marked closed and the handler is set to internalEntityProcessor, the outer entity is considered to have been parsed completely, so it is marked closed and openInternalEntities is set to null. When we unblock the parser we end up in internalEntityProcessor with a null openInternalEntities, which is a bogus state and we report an error.

So, this is generated when Firefox is trying to render the XML for the page, the XML parser gets into a bad state and reports the error. There is a patch, but it seems it has not yet been introduced (the bug is still open on the Mozilla tracker). Note that this bug is from (at least) 2010, it is not a sign of compromise, just a sign of the (over-)complexity of XML.

Improve this answer
2
  • Thanks for reply. Can any malicious website use this bug to compromise my security?
    – optimus prime
    Commented Oct 19, 2016 at 5:21
  • 1
    Unlikely, they wouldn't have a lot of control over the input parameters. XML parsing bugs are not unheard of but I think in that specific case, it's not an attack vector or a sign of compromise. I wouldn't say "No" but I don't think it likely. You'd be far more likely to get compromised by actually loading the intended page than an error page about a network connection failure. :P
    – cacahuatl
    Commented Oct 19, 2016 at 10:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .