CVE-2015-6964

Published Sep 25, 2023

Last updated 2 months ago

CVSS medium 5.3

Overview

Description: MultiBit HD before 0.1.2 allows attackers to conduct bit-flipping attacks that insert unspendable Bitcoin addresses into the list that MultiBit uses to send fees to the developers. (Attackers cannot realistically steal these fees for themselves.) This occurs because there is no message authentication code (MAC).
Source: cve@mitre.org
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.3
Impact score: 1.4
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-697
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-697

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:multibit:multibit_hd:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C29BB444-01F8-4CBA-9BB4-9F59FE2455CB",
            "versionEndExcluding": "0.1.2"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References