PT-2012-1881 · Wxbitcoin+1 · Wxbitcoin+1

Publicado 2012-08-06 · Atualizado 2020-03-18 · CVE-2011-4447

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions bitcoind versions 0.4.0 through 0.4.1 bitcoind version 0.5.0rc wxBitcoin (affected versions not specified)

Description The issue arises from the improper interaction between the "encrypt wallet" feature and the deletion functionality of BSDDB. This allows attackers to obtain unencrypted private keys from Bitcoin wallet files by bypassing the BSDDB interface and reading entries marked for deletion.

Recommendations For bitcoind versions 0.4.0 through 0.4.1, update to version 0.4.1 or later to resolve the issue. For bitcoind version 0.5.0rc, update to a newer version to mitigate the risk. For wxBitcoin, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2011-4447

Produtos afetados

Bitcoind

Wxbitcoin

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2011-4447 · Nota de Segurança
• https://bitcointalk.org/index.php?topic=51474.0 · Nota
• http://bitcoin.org/releases/2011/11/21/v0.5.0.html · Nota
• https://bitcointalk.org/index.php?topic=51604.0 · Nota
• https://en.bitcoin.it/wiki/CVEs · Aviso do Fabricante