Bitcoin Forum
May 10, 2024, 09:29:35 PM *
News: Latest Bitcoin Core release: 27.0 [Torrent]
 
   Home   Help Search Login Register More  
Pages: [1]
  Print  
Author Topic: 2012-08-13 us-cert.gov - Vulnerability Summary for the Week of August 6, 2012  (Read 1351 times)
julz (OP)
Legendary
*
Offline Offline

Activity: 1092
Merit: 1001



View Profile
August 13, 2012, 11:49:26 PM
 #1

Not exactly a 'press hit' - but given the wording "allows remote attackers to bypass intended economic restrictions and create many bitcoins via a crafted Bitcoin transaction" - I wouldn't be surprised if this generates some press.

Quote
Bulletin (SB12-226)
Vulnerability Summary for the Week of August 6, 2012

2012-08-13

http://www.us-cert.gov/cas/bulletins/SB12-226.html


...
bitcoin -- bitcoind
Integer overflow in wxBitcoin and bitcoind before 0.3.11 allows remote attackers to bypass intended economic restrictions and create many bitcoins via a crafted Bitcoin transaction.    2012-08-06   7.5   CVE-2010-5139


bitcoin -- bitcoind
wxBitcoin and bitcoind before 0.3.5 do not properly handle script opcodes in Bitcoin transactions, which allows remote attackers to spend bitcoins owned by other users via unspecified vectors.    2012-08-06   7.5   CVE-2010-5141


bitcoin -- bitcoin-qt
Bitcoin-Qt 0.5.0.x before 0.5.0.5; 0.5.1.x, 0.5.2.x, and 0.5.3.x before 0.5.3.1; and 0.6.x before 0.6.0rc4 on Windows does not use MinGW multithread-safe exception handling, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted Bitcoin protocol messages.    2012-08-06   7.5   CVE-2012-1910

...


From the linked vulnerability record at http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-5139

Quote
Impact Type:Allows unauthorized disclosure of information; Allows unauthorized modification; Allows disruption of service

that NIST record appears to reference a 2010 bitcointalk thread.
https://bitcointalk.org/index.php?topic=822.0

Interesting that this should pop up now. :/



@electricwings   BM-GtyD5exuDJ2kvEbr41XchkC8x9hPxdFd
1715376575
Hero Member
*
Offline Offline

Posts: 1715376575

View Profile Personal Message (Offline)

Ignore
1715376575
Reply with quote  #2

1715376575
Report to moderator
1715376575
Hero Member
*
Offline Offline

Posts: 1715376575

View Profile Personal Message (Offline)

Ignore
1715376575
Reply with quote  #2

1715376575
Report to moderator
The grue lurks in the darkest places of the earth. Its favorite diet is adventurers, but its insatiable appetite is tempered by its fear of light. No grue has ever been seen by the light of day, and few have survived its fearsome jaws to tell the tale.
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction.
1715376575
Hero Member
*
Offline Offline

Posts: 1715376575

View Profile Personal Message (Offline)

Ignore
1715376575
Reply with quote  #2

1715376575
Report to moderator
1715376575
Hero Member
*
Offline Offline

Posts: 1715376575

View Profile Personal Message (Offline)

Ignore
1715376575
Reply with quote  #2

1715376575
Report to moderator
1715376575
Hero Member
*
Offline Offline

Posts: 1715376575

View Profile Personal Message (Offline)

Ignore
1715376575
Reply with quote  #2

1715376575
Report to moderator
blueadept
Full Member
***
Offline Offline

Activity: 225
Merit: 101


View Profile
August 14, 2012, 12:03:18 AM
 #2

Nobody runs this version any more, and even those that do are safe as long as they wait several blocks before accepting transactions to make sure they aren't being fed bogus bitcoins.

Like my posts?  Connect with me on LinkedIn and endorse my "Bitcoin" skill.
Decentralized, instant off-chain payments.
Pages: [1]
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!