PT-2020-8189 · Bitcoin+1 · Bitcoin-Qt+2

Published 2017-11-10 · Updated 2020-03-18 · CVE-2017-18350

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: bitcoind and Bitcoin-Qt versions prior to 0.15.1

Description: The issue results from an integer signedness error when an attacker-controlled SOCKS proxy server responds with an acknowledgement of an unexpected target domain name, leading to a stack-based buffer overflow. This occurs when the proxy server is used with bitcoind and Bitcoin-Qt.

Recommendations: For versions prior to 0.15.1, update to version 0.15.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of attacker-controlled SOCKS proxy servers until a patch is applied.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

ALT-PU-2017-2620

CVE-2017-18350

Affected Products

Alt Linux

Bitcoin-Qt

Bitcoind

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-18350 · Security Note
• https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-18350 · Vendor Advisory
• https://medium.com/%40lukedashjr/cve-2017-18350-disclosure-fe6d695f45d5 · Note
• https://t.me/cibsecurity/10486 · Telegram Post
• https://t.me/cvenotify/1606 · Telegram Post