PT-2013-4881 · Bitcoin · Bitcoind

Grayleonard · Published 2013-08-01 · Updated 2020-03-18 · CVE-2013-4165

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions bitcoind version 0.8.1

Description The issue allows remote attackers to determine passwords via a timing side-channel attack. This is due to the HTTPAuthorized function in bitcoinrpc.cpp providing information about authentication failure upon detecting the first incorrect byte of a password.

Recommendations For bitcoind version 0.8.1, consider disabling the HTTPAuthorized function as a temporary workaround until a patch is available. Restrict access to the bitcoinrpc.cpp module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2013-4165

Affected Products

Bitcoind

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2013-4165 · Security Note
• https://github.com/bitcoin/bitcoin/pull/2845 · Note
• https://github.com/bitcoin/bitcoin/issues/2838 · Note
• http://openwall.com/lists/oss-security/2013/07/25/5 · Note