CVE-2017-18350 Memory corruption in n/a
A stack-based buffer overflow in Bitcoin clients allows code execution if a malicious SOCKS proxy is configured.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-18350?
CVE-2017-18350 is a medium-severity memory corruption vulnerability in Bitcoin Bitcoin Core, published on 12 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
bitcoind and Bitcoin-Qt prior to 0.15.1 have a stack-based buffer overflow if an attacker-controlled SOCKS proxy server is used. This results from an integer signedness error when the proxy server responds with an acknowledgement of an unexpected target domain name.
Weakness: CWE-120
Which versions are affected by CVE-2017-18350?
It affects 1 product.
Products include Bitcoin Bitcoin Core.
How do I fix CVE-2017-18350?
No fix has been published for CVE-2017-18350 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2017-18350 being exploited?
There is no known exploitation of CVE-2017-18350 in the wild and no public exploit code.
Other vulnerabilities in Bitcoin Bitcoin Core
Sources
Also known as GHSA-xwpp-3gx9-68rr.