PT-2021-11073 · Zcfees · Zcfees

Published 2021-02-10 · Updated 2021-02-17 · CVE-2020-24837

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: ZCFees version latest

Description: An integer underflow issue has been identified, involving the variables currPeriodIdx and lastPeriodExecIdx, which are unsigned integers. The result of the minus operation between these variables may yield a negative integer, leading to an underflow. Attackers can potentially modify the current transaction timestamp, thereby blocking the execution of the process function.

Recommendations: For ZCFees version latest, consider restricting access to the process function until a patch is available to prevent exploitation of the integer underflow issue. As a temporary workaround, avoid using the variables currPeriodIdx and lastPeriodExecIdx in transactions that could lead to underflow conditions.

Fix

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

CVE-2020-24837

Affected Products

Zcfees

References · 3

• https://etherscan.io/address/0x9d79c6e2a0222b9ac7bfabc447209c58fe9e0dcc#code · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-24837 · Security Note
• https://t.me/cibsecurity/23355 · Telegram Post