PT-2018-4890 · Bitcoin+1 · Bitcoin Knots+2

Achow101 + 1 · Publicado 2017-09-17 · Atualizado 2020-03-18 · CVE-2016-10724

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Bitcoin Core versions prior to 0.13.0 Bitcoin Knots versions prior to 0.13.0.knots20160814

Description The issue allows for denial of service through memory exhaustion, triggered by the remote network alert system. This system is deprecated since Q1 2016. An attacker can exploit this by signing a message with a certain private key that had been known by unintended actors, due to an infinitely sized map. This affects not only Bitcoin Core but also other uses of the codebase, including Bitcoin Knots and many altcoins.

Recommendations For Bitcoin Core versions prior to 0.13.0, update to version 0.13.0 or later. For Bitcoin Knots versions prior to 0.13.0.knots20160814, update to version 0.13.0.knots20160814 or later.

Exploit

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

ALT-PU-2017-2217

CVE-2016-10724

Produtos afetados

Alt Linux

Bitcoin Core

Bitcoin Knots

Referências · 6

• 🔥 https://github.com/JinBean/CVE-Extension · Exploit
• https://osv.dev/vulnerability/CVE-2016-10724 · Aviso do Fabricante
• https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-10724 · Nota de Segurança
• https://bitcoin.org/en/posts/alert-key-and-vulnerabilities-disclosure · Nota
• https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2018-July/016189.html · Nota