PT-2023-10320 · Unknown · Multibit Hd

Published 2023-09-25 · Updated 2024-09-25 · CVE-2015-6964

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions MultiBit HD versions prior to 0.1.2

Description The issue allows attackers to conduct bit-flipping attacks, inserting unspendable Bitcoin addresses into the list used to send fees to the developers. This is due to the lack of a message authentication code (MAC), but attackers cannot realistically steal these fees for themselves.

Recommendations For versions prior to 0.1.2, update to version 0.1.2 or later to resolve the issue. As a temporary workaround, consider disabling the feature that sends fees to the developers until a patch is available. Restrict access to the list of Bitcoin addresses used for fee payments to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-697

Related Identifiers

CVE-2015-6964

Affected Products

Multibit Hd

References · 5

• 🔥 https://web.archive.org/web/20160506095434/https://multibit.org/blog/2015/07/25/bit-flipping-attack.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-6964 · Security Note
• https://t.me/cvenotify/58534 · Telegram Post
• https://t.me/cvenotify/58612 · Telegram Post
• https://t.me/cibsecurity/70974 · Telegram Post