PT-2023-9995 · Ziftr · Ziftr Primecoin

Published 2023-01-01 · Updated 2024-05-17 · CVE-2013-10006

Positive Technologies (AI Summary)

CVSS v2.0

1.4

Low

Base vector

AV:A/AC:H/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ziftr primecoin versions up to 0.8.4rc1

Description A vulnerability was found in the function HTTPAuthorized of the file src/bitcoinrpc.cpp. The manipulation of the argument strUserPass/strRPCUserColonPass leads to observable timing discrepancy. The complexity of an attack is rather high, and the exploitation appears to be difficult.

Recommendations For Ziftr primecoin versions up to 0.8.4rc1, upgrade to version 0.8.4rc2 to address this issue. As a temporary workaround, consider restricting access to the HTTPAuthorized function until the patch is applied.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

CWE-208

Related Identifiers

CVE-2013-10006

Affected Products

Ziftr Primecoin

References · 7

• https://github.com/Ziftr/primecoin/releases/tag/v0.8.4rc2 · Patch
• https://github.com/Ziftr/primecoin/commit/cdb3441b5cd2c1bae49fae671dc4a496f7c96322 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2013-10006 · Security Note
• https://vuldb.com/?ctiid.217171 · Note
• https://t.me/cibsecurity/55727 · Telegram Post
• https://t.me/cvenotify/41101 · Telegram Post
• https://vuldb.com/?id.217171 · Note