Common Vulnerabilities and Exposures: Difference between revisions

From Bitcoin Wiki
Jump to navigation Jump to search
← Older editNewer edit →
Luke-jr (talk | contribs)
Clerks, Administrators, Editors
3,074 edits
No edit summary
Luke-jr (talk | contribs)
Clerks, Administrators, Editors
3,074 edits
Severity levels
Line 1: Line 1:
{| class="wikitable"
{| class="wikitable"
!style="width:14ex"| CVE
!style="width:14ex"| CVE
! Announced !! Affects !! Flaw !! Net
! Announced !! Affects !! Severity !! Attack is... !! Flaw !! Net
|-
|-
| [[#CVE-2010-5137|CVE-2010-5137]]
| [[#CVE-2010-5137|CVE-2010-5137]]
| 2010-07-28
| 2010-07-28
| wxBitcoin and bitcoind
| wxBitcoin and bitcoind
|bgcolor=yellow| DoS<ref name="DoS">Attacker can disable some functionality, for example by crashing clients</ref>
|bgcolor=pink| Easy
| OP_LSHIFT crash
| OP_LSHIFT crash
|bgcolor=lime| 100%
|-
|
| 2010-07-28
| wxBitcoin and bitcoind
|bgcolor=pink| Theft<ref name="Theft">Attacker can take or create money outside known network rules</ref>
|bgcolor=pink| Easy
|
|bgcolor=lime| 100%
|bgcolor=lime| 100%
|-
|-
Line 12: Line 22:
| 2010-07-29
| 2010-07-29
| wxBitcoin and bitcoind
| wxBitcoin and bitcoind
|bgcolor=yellow| DoS<ref name="DoS"/>
|bgcolor=pink| Easy
| Unlimited SigOp DoS
| Unlimited SigOp DoS
|bgcolor=lime| 100%
|bgcolor=lime| 100%
Line 18: Line 30:
| 2010-08-15
| 2010-08-15
| wxBitcoin and bitcoind
| wxBitcoin and bitcoind
|bgcolor=pink| Theft<ref name="Theft"/>
|bgcolor=pink| Easy
| Combined output overflow
| Combined output overflow
|bgcolor=lime| 100%
|bgcolor=lime| 100%
Line 24: Line 38:
| 2010-09-29
| 2010-09-29
| wxBitcoin and bitcoind
| wxBitcoin and bitcoind
|bgcolor=yellow| DoS<ref name="DoS"/>
|bgcolor=pink| Easy
| Never confirming transactions
| Never confirming transactions
|bgcolor=lime| 100%
|bgcolor=lime| 100%
Line 30: Line 46:
| 2011-11-11
| 2011-11-11
| wxBitcoin and bitcoind
| wxBitcoin and bitcoind
|bgcolor=pink| Exposure<ref name="Exposure">Attacker can access user data outside known acceptable methods</ref>
|bgcolor=lime| Hard
| Wallet non-encryption
| Wallet non-encryption
|bgcolor=yellow| [http://luke.dashjr.org/programs/bitcoin/files/charts/CVE-2011-4447.html 93%]
|bgcolor=yellow| [http://luke.dashjr.org/programs/bitcoin/files/charts/CVE-2011-4447.html 93%]
Line 36: Line 54:
| 2012-03-07
| 2012-03-07
| Bitcoin protocol and all clients
| Bitcoin protocol and all clients
|bgcolor=pink| Netsplit<ref name="Netsplit">Attacker can create multiple views of the network, enabling double-spending with over 1 confirmation</ref>
|bgcolor=lime| Very hard
| Transaction overwriting
| Transaction overwriting
|bgcolor=pink| [http://luke.dashjr.org/programs/bitcoin/files/charts/CVE-2012-1909.html 68%]
|bgcolor=pink| [http://luke.dashjr.org/programs/bitcoin/files/charts/CVE-2012-1909.html 68%]
Line 42: Line 62:
| 2012-03-17
| 2012-03-17
| Bitcoin-Qt for Windows
| Bitcoin-Qt for Windows
|bgcolor=pink| Unknown<ref name="Unknown">Extent of possible abuse is unknown</ref>
|bgcolor=lime| Hard
| MingW non-multithreading
| MingW non-multithreading
|bgcolor=lime| [http://luke.dashjr.org/programs/bitcoin/files/charts/CVE-2012-1910.html 95%]
|bgcolor=lime| [http://luke.dashjr.org/programs/bitcoin/files/charts/CVE-2012-1910.html 95%]
Line 48: Line 70:
| 2012-04-01
| 2012-04-01
| All Bitcoin clients
| All Bitcoin clients
|bgcolor=yellow| Fake Conf<ref name="FakeConf">Attacker can double-spend with 1 confirmation</ref>
|bgcolor=yellow| Miners<ref name="MinerEasy">Attacking requires mining block(s)</ref>
| Mandatory P2SH protocol update
| Mandatory P2SH protocol update
|bgcolor=pink| [http://luke.dashjr.org/programs/bitcoin/files/charts/BIP-0016.html 65%]
|bgcolor=pink| [http://luke.dashjr.org/programs/bitcoin/files/charts/BIP-0016.html 65%]
Line 54: Line 78:
| 2012-05-14
| 2012-05-14
| bitcoind and Bitcoin-Qt
| bitcoind and Bitcoin-Qt
|bgcolor=pink| TBD
|bgcolor=pink| Easy
| TBD (at net ~77%)
| TBD (at net ~77%)
|bgcolor=pink| [http://luke.dashjr.org/programs/bitcoin/files/charts/CVE-2012-2459.html 60%]
|bgcolor=pink| [http://luke.dashjr.org/programs/bitcoin/files/charts/CVE-2012-2459.html 60%]
|}
|}
<references/>
__NOTOC__
__NOTOC__


Revision as of 02:53, 10 June 2012

CVE Announced Affects Severity Attack is... Flaw Net
CVE-2010-5137 2010-07-28 wxBitcoin and bitcoind DoS[1] Easy OP_LSHIFT crash 100%
2010-07-28 wxBitcoin and bitcoind Theft[2] Easy 100%
CVE-2010-5138 2010-07-29 wxBitcoin and bitcoind DoS[1] Easy Unlimited SigOp DoS 100%
CVE-2010-5139 2010-08-15 wxBitcoin and bitcoind Theft[2] Easy Combined output overflow 100%
CVE-2010-5140 2010-09-29 wxBitcoin and bitcoind DoS[1] Easy Never confirming transactions 100%
CVE-2011-4447 2011-11-11 wxBitcoin and bitcoind Exposure[3] Hard Wallet non-encryption 93%
CVE-2012-1909 2012-03-07 Bitcoin protocol and all clients Netsplit[4] Very hard Transaction overwriting 68%
CVE-2012-1910 2012-03-17 Bitcoin-Qt for Windows Unknown[5] Hard MingW non-multithreading 95%
BIP 0016 2012-04-01 All Bitcoin clients Fake Conf[6] Miners[7] Mandatory P2SH protocol update 65%
CVE-2012-2459 2012-05-14 bitcoind and Bitcoin-Qt TBD Easy TBD (at net ~77%) 60%
  1. ↑ 1.0 1.1 1.2 Attacker can disable some functionality, for example by crashing clients
  2. ↑ 2.0 2.1 Attacker can take or create money outside known network rules
  3. ↑ Attacker can access user data outside known acceptable methods
  4. ↑ Attacker can create multiple views of the network, enabling double-spending with over 1 confirmation
  5. ↑ Extent of possible abuse is unknown
  6. ↑ Attacker can double-spend with 1 confirmation
  7. ↑ Attacking requires mining block(s)


CVE-2010-5137

Date: 2010-07-28
Summary: OP_LSHIFT crash
Fix Deployment: 100%
Affected Fix
bitcoind
wxBitcoin		 * - 0.3.4 0.3.5

On July 28 2010 two bugs were discovered and demonstrated on the test network. The first caused bitcoin to crash on some machines when processing a transaction containing an OP_LSHIFT. The second exploited another bug in the transaction handling code and allowed an attacker to spend coins that they did not own. Neither were exploited on the main network, and both were fixed by Bitcoin version 0.3.5.

After these bugs were discovered, many currently-unused script words were disabled for safety.


CVE-2010-5138

Date: 2010-07-29
Summary: Unlimited SigOp DoS
Fix Deployment: 100%
Affected Fix
bitcoind
wxBitcoin		 * - 0.3.? 0.3.?

On July 29 2010, it was discovered that block 71036 contained several transactions with a ton of OP_CHECKSIG commands. There should only ever be one such command. This caused every node to do extra unnecessary work, and it could have been used as a denial-of-service attack. A new version of Bitcoin was quickly released. The new version did not cause a fork on the main network, though it did cause one on the test network (where someone had played around with the attack more).


CVE-2010-5139

Date: 2010-08-15
Summary: Combined output overflow
Fix Deployment: 100%
Affected Fix
bitcoind
wxBitcoin		 * - 0.3.10 0.3.11

On August 15 2010, it was discovered that block 74638 contained a transaction that created over 184 billion bitcoins for two different addresses. This was possible because the code used for checking transactions before including them in a block didn't account for the case of outputs so large that they overflowed when summed. A new version was published within a few hours of the discovery. The block chain had to be forked. Although many unpatched nodes continued to build on the "bad" block chain, the "good" block chain overtook it at a block height of 74691. The bad transaction no longer exists for people using the longest chain.

The block and transaction: 

CBlock(hash=0000000000790ab3, ver=1, hashPrevBlock=0000000000606865, hashMerkleRoot=618eba,
nTime=1281891957, nBits=1c00800e, nNonce=28192719, vtx=2)
  CTransaction(hash=012cd8, ver=1, vin.size=1, vout.size=1, nLockTime=0)
    CTxIn(COutPoint(000000, -1), coinbase 040e80001c028f00)
    CTxOut(nValue=50.51000000, scriptPubKey=0x4F4BA55D1580F8C3A8A2C7)
  CTransaction(hash=1d5e51, ver=1, vin.size=1, vout.size=2, nLockTime=0)
    CTxIn(COutPoint(237fe8, 0), scriptSig=0xA87C02384E1F184B79C6AC)
    CTxOut(nValue=92233720368.54275808, scriptPubKey=OP_DUP OP_HASH160 0xB7A7)
    CTxOut(nValue=92233720368.54275808, scriptPubKey=OP_DUP OP_HASH160 0x1512)
  vMerkleTree: 012cd8 1d5e51 618eba

Block hash: 0000000000790ab3f22ec756ad43b6ab569abf0bddeb97c67a6f7b1470a7ec1c
Transaction hash: 1d5e512a9723cbef373b970eb52f1e9598ad67e7408077a82fdac194b65333c9

References


CVE-2010-5140

Date: 2010-09-29
Summary: Never confirming transactions
Fix Deployment: 100%
Affected Fix
bitcoind
wxBitcoin		 * - 0.3.12 0.3.13

Around September 29, 2010, people started reporting that their sent transactions would not confirm. This happened because people modified Bitcoin to send sub-0.01 transactions without any fees. A 0.01 fee was at that time required by the network for such transactions (essentially prohibiting them), so the transactions remained at 0 confirmations forever. This became a more serious issue because Bitcoin would send transactions using bitcoins gotten from transactions with 0 confirmations, and these resulting transactions would also never confirm. Because Bitcoin tends to prefer sending smaller coins, these invalid transactions quickly multiplied, contaminating the wallets of everyone who received them.

Bitcoin was changed to only select coins with at least 1 confirmation. The remaining sub-0.01 transactions were cleared by generators who modified their version of Bitcoin to not require the micropayment fee. It took a while for everything to get cleared, though, because many of the intermediate transactions had been forgotten by the network by this point and had to be rebroadcast by the original senders.

References


CVE-2011-4447

Date: 2011-11-11
Summary: Wallet non-encryption
Fix Deployment: 92.8%
Affected Fix
bitcoind
wxBitcoin		 0.4.0 - 0.4.1rc6 0.4.1
0.5.0

References


CVE-2012-1909

Date: 2012-03-07
Summary: Transaction overwriting
Fix Deployment: 68%
Affected Fix
Bitcoin protocol Before March 15th, 2012 BIP 30
Bitcoin-Qt
bitcoind		 * - 0.4.4rc2
0.5.0rc1 - 0.5.0.4rc2
0.5.1rc1 - 0.5.3rc2
0.6.0rc1 - 0.6.0rc2		 0.4.4
0.5.0.4
0.5.3
0.6.0rc3
wxBitcoin ALL NONE

References


CVE-2012-1910

Date: 2012-03-17
Summary: MingW non-multithreading
Fix Deployment: 95%
Affected Fix
Bitcoin-Qt for Windows 0.5.0rc1 - 0.5.0.4
0.5.1rc1 - 0.5.3.0
0.6.0rc1 - 0.6.0rc3		 0.5.0.5
0.5.3.1
0.5.4
0.6.0rc4

References

BIP-0016

Date: 2012-04-01
Summary: Mandatory P2SH protocol update
Deployment: 65%
Affected Fix
Bitcoin-Qt
bitcoind		 * - 0.4.4
0.5.0rc1 - 0.5.0.5
0.5.1rc1 - 0.5.3
0.6.0rc1		 0.4.5
0.5.0.6
0.5.4rc1
0.6.0rc2
wxBitcoin ALL NONE

References


CVE-2012-2459

Date: 2012-05-14
Summary: To Be Disclosed (when network deployment reaches about 77%)
Fix Deployment: 60%
Affected Fix
Bitcoin-Qt
bitcoind		 * - 0.4.6rc1
0.5.0rc1 - 0.5.5rc1
0.6.0rc1 - 0.6.0.7rc1
0.6.1rc1 - 0.6.1		 0.4.6
0.5.5
0.6.0.7
0.6.2

References

Retrieved from "https://en.bitcoin.it/w/index.php?title=Common_Vulnerabilities_and_Exposures&oldid=27613"