|
Title: Vulnerability in mmcFE Manual Withdrawal Logic Post by: the1silverwolf on June 09, 2013, 06:00:52 AM To: Any pool operator using mmcFE or any one of a dozen derivative forks.
A vulnerability has been discovered in the Manual Withdrawal logic that can allow Withdrawals to be duplicated. The vulnerability is in accountdetails.php. Essentially firing off several withdrawal requests in less than a second can sometimes allow multiple withdrawals to be processed. Resulting in duplicate payments being sent before the first one completes and the users account balance is set to 0. You should disable manual withdrawal until you can code a work around. Details here : https://bitcointalk.org/index.php?topic=228419.msg2416246#msg2416246 (https://bitcointalk.org/index.php?topic=228419.msg2416246#msg2416246) Moderator : you might want to make this thread a sticky as there are tons of pools based upon this code. Title: Re: Vulnerability in mmcFE Manual Withdrawal Logic Post by: John (John K.) on June 09, 2013, 07:15:44 AM Stickied for the time being.
Title: Re: Vulnerability in mmcFE Manual Withdrawal Logic Post by: NetcodePool on June 14, 2013, 09:23:36 PM Check your ledger for debit_atp. You may find double payments there as well.
Title: Re: Vulnerability in mmcFE Manual Withdrawal Logic Post by: bernard75 on June 15, 2013, 09:25:51 PM Wow, thats some serious shit.
Title: Re: Vulnerability in mmcFE Manual Withdrawal Logic Post by: fcmatt on June 26, 2013, 02:15:27 AM Here is a quick fix that i posted in this thread.
one might want to clean it up a bit so you do not reuse variable names but it does work fine. https://bitcointalk.org/index.php?topic=239207.msg2533156#msg2533156 Title: Re: Vulnerability in mmcFE Manual Withdrawal Logic Post by: John (John K.) on July 05, 2013, 05:15:36 PM I guess it should be pretty much seen and solved by all pool OP's by now. Unstickied for the time being.
|