CVE-2016-10725 Business logic in n/a
Attackers can block critical final alerts by sending non-final alerts due to incorrect processing order in the deprecated network alert system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-10725?
CVE-2016-10725 is a high-severity vulnerability in Bitcoin Bitcoin Core, published on 5 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Bitcoin Core before v0.13.0, a non-final alert is able to block the special "final alert" (which is supposed to override all other alerts) because operations occur in the wrong order. This behavior occurs in the remote network alert system (deprecated since Q1 2016). This affects other uses of the codebase, such as Bitcoin Knots before v0.13.0.knots20160814 and many altcoins.
Weakness: CWE-310
Which versions are affected by CVE-2016-10725?
It affects 3 products.
Products include Bitcoin Bitcoin-Qt, Bitcoin Bitcoin Core, Bitcoin Bitcoind.
How do I fix CVE-2016-10725?
No fix has been published for CVE-2016-10725 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-10725 being exploited?
There is no known exploitation of CVE-2016-10725 in the wild and no public exploit code.
Other vulnerabilities in Bitcoin Bitcoin Core
Sources
Also known as GHSA-jwcj-g4qr-gj44.