en	[[!meta title="Iceweasel exposes a rare User-Agent"]]

en	[[!tag security/fixed]]

en	A Torbutton bug ([[!debbug 595375]]) makes Iceweasel expose a recognizable User-Agent when the "Spoof US English Browser" setting is disabled, which is the case in T(A)ILS 0.5.

en	Impact

en	System administrators, webmasters and anyone able to read the logs of a website are able to single out, amongst the visitors, the ones that are using an affected Torbutton extension *and* have explicitly disabled the "Spoof US English Browser" setting.

en	While T(A)ILS users are obviously not the only ones in this case, such a bug eases fingerprinting.

en	The client IP address recorded in the webserver logs for such a connection is the one of the Tor exit node used by the T(A)ILS user at this time.

en	Solution

en	Upgrade to T(A)ILS 0.6.

en	Mitigation on T(A)ILS 0.5

en	The following steps need to be done immediately after boot, **before** running Iceweasel.

en	Run the following command in a terminal:

en	... this opens a text editor. Delete the line that says:

en	user_pref("extensions.torbutton.spoof_english", false);

en	... then save and quit. You can now run Iceweasel.

en	Beware! Changing this setting in the Torbutton preferences window is **not** effective.

en	Affected versions

en	Torbutton 1.2.5, included in T(A)ILS 0.5