NVD

Id
39820  
Name
CVE-2013-4165  
Description
The HTTPAuthorized function in bitcoinrpc.cpp in bitcoind 0.8.1 provides information about authentication failure upon detecting the first incorrect byte of a password, which makes it easier for remote attackers to determine passwords via a timing side-channel attack.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-18  
Published
2013-08-02  
Modified Date
2013-10-11  
Seq
2013-4165  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
202588 39820 CVE-2013-4165 [oss-security] 20130725 Re: CVE request: timing leak in bitcoind  View
202589 39820 CVE-2013-4165 https://github.com/bitcoin/bitcoin/issues/2838  View
202590 39820 CVE-2013-4165 https://github.com/bitcoin/bitcoin/pull/2845  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
22061 JVNDB-2013-003636 bitcoind の bitcoinrpc.cpp の HTTPAuthorized 関数におけるパスワードを断定される脆弱性 bitcoind の bitcoinrpc.cpp の HTTPAuthorized 関数は、パスワードと異なるバイト (文字) を検出すると認証失敗についての情報を返すため、パスワードを断定される脆弱性が存在します。 CVE-2013-4165 64107 CVE-2013-4165 39820 4.3 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-003636.html 2013-07-20 2013-10-24 View