PT-2023-9995 · Ziftr · Ziftr Primecoin

Publicado 2023-01-01 · Atualizado 2024-05-17 · CVE-2013-10006

Positive Technologies (AI Summary)

CVSS v2.0

1.4

Baixa

Vetor base

AV:A/AC:H/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ziftr primecoin versions up to 0.8.4rc1

Description A vulnerability was found in the function HTTPAuthorized of the file src/bitcoinrpc.cpp. The manipulation of the argument strUserPass/strRPCUserColonPass leads to observable timing discrepancy. The complexity of an attack is rather high, and the exploitation appears to be difficult.

Recommendations For Ziftr primecoin versions up to 0.8.4rc1, upgrade to version 0.8.4rc2 to address this issue. As a temporary workaround, consider restricting access to the HTTPAuthorized function until the patch is applied.

Correção

Side Channel Attack

Enumeração de Fraquezas

CWE-203

CWE-208

Identificadores relacionados

CVE-2013-10006

Produtos afetados

Ziftr Primecoin

Referências · 7

• https://github.com/Ziftr/primecoin/releases/tag/v0.8.4rc2 · Correção
• https://github.com/Ziftr/primecoin/commit/cdb3441b5cd2c1bae49fae671dc4a496f7c96322 · Correção
• https://vuldb.com/?ctiid.217171 · Nota
• https://t.me/cibsecurity/55727 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2013-10006 · Nota de Segurança
• https://t.me/cvenotify/41101 · Publicação no Telegram
• https://vuldb.com/?id.217171 · Nota