PT-2013-4881 · Bitcoin · Bitcoind

Grayleonard · Publicado 2013-08-01 · Atualizado 2020-03-18 · CVE-2013-4165

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions bitcoind version 0.8.1

Description The issue allows remote attackers to determine passwords via a timing side-channel attack. This is due to the HTTPAuthorized function in bitcoinrpc.cpp providing information about authentication failure upon detecting the first incorrect byte of a password.

Recommendations For bitcoind version 0.8.1, consider disabling the HTTPAuthorized function as a temporary workaround until a patch is available. Restrict access to the bitcoinrpc.cpp module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2013-4165

Produtos afetados

Bitcoind

Referências · 4

• https://github.com/bitcoin/bitcoin/pull/2845 · Nota
• https://github.com/bitcoin/bitcoin/issues/2838 · Nota
• http://openwall.com/lists/oss-security/2013/07/25/5 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-4165 · Nota de Segurança