PT-2012-1881 · Wxbitcoin+1 · Wxbitcoin+1

Published 2012-08-06 · Updated 2020-03-18 · CVE-2011-4447

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions bitcoind versions 0.4.0 through 0.4.1 bitcoind version 0.5.0rc wxBitcoin (affected versions not specified)

Description The issue arises from the improper interaction between the "encrypt wallet" feature and the deletion functionality of BSDDB. This allows attackers to obtain unencrypted private keys from Bitcoin wallet files by bypassing the BSDDB interface and reading entries marked for deletion.

Recommendations For bitcoind versions 0.4.0 through 0.4.1, update to version 0.4.1 or later to resolve the issue. For bitcoind version 0.5.0rc, update to a newer version to mitigate the risk. For wxBitcoin, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2011-4447

Affected Products

Bitcoind

Wxbitcoin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2011-4447 · Security Note
• https://en.bitcoin.it/wiki/CVEs · Vendor Advisory
• https://bitcointalk.org/index.php?topic=51474.0 · Note
• http://bitcoin.org/releases/2011/11/21/v0.5.0.html · Note
• https://bitcointalk.org/index.php?topic=51604.0 · Note