PT-2018-4891 · Bitcoin+1 · Bitcoin Knots+2

Achow101 · Published 2017-09-17 · Updated 2020-03-18 · CVE-2016-10725

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Bitcoin Core versions prior to 0.13.0 Bitcoin Knots versions prior to 0.13.0.knots20160814

Description The issue arises from the incorrect order of operations in the remote network alert system, which is deprecated since Q1 2016. This allows a non-final alert to block the special "final alert" that is intended to override all other alerts. The problem affects not only Bitcoin Core but also other uses of the codebase, including Bitcoin Knots and many altcoins.

Recommendations For Bitcoin Core versions prior to 0.13.0, update to version 0.13.0 or later. For Bitcoin Knots versions prior to 0.13.0.knots20160814, update to version 0.13.0.knots20160814 or later.

Exploit

Fix

Weakness Enumeration

CWE-310

Related Identifiers

ALT-PU-2017-2217

CVE-2016-10725

Affected Products

Alt Linux

Bitcoin Core

Bitcoin Knots

References · 6

• 🔥 https://github.com/JinBean/CVE-Extension · Exploit
• https://osv.dev/vulnerability/CVE-2016-10725 · Vendor Advisory
• https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10725 · Security Note
• https://bitcoin.org/en/posts/alert-key-and-vulnerabilities-disclosure · Note
• https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2018-July/016189.html · Note