Vulnerability Description
The penny-flooding protection mechanism in the CTxMemPool::accept method in bitcoind and Bitcoin-Qt before 0.4.9rc1, 0.5.x before 0.5.8rc1, 0.6.0 before 0.6.0.11rc1, 0.6.1 through 0.6.5 before 0.6.5rc1, and 0.7.x before 0.7.3rc1 allows remote attackers to determine associations between wallet addresses and IP addresses via a series of large Bitcoin transactions with insufficient fees.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitcoin | Bitcoin-Qt | <= 0.4.8 |
| Bitcoin | Bitcoin Core | All versions |
| Bitcoin | Bitcoind | <= 0.4.4 |
Related Weaknesses (CWE)
References
- https://bitcointalk.org/?topic=135856
- https://en.bitcoin.it/wiki/CVEs
- https://bitcointalk.org/?topic=135856
- https://en.bitcoin.it/wiki/CVEs
FAQ
What is CVE-2013-2272?
CVE-2013-2272 is a vulnerability with a CVSS score of 5.0 (MEDIUM). The penny-flooding protection mechanism in the CTxMemPool::accept method in bitcoind and Bitcoin-Qt before 0.4.9rc1, 0.5.x before 0.5.8rc1, 0.6.0 before 0.6.0.11rc1, 0.6.1 through 0.6.5 before 0.6.5rc...
How severe is CVE-2013-2272?
CVE-2013-2272 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2013-2272?
Check the references section above for vendor advisories and patch information. Affected products include: Bitcoin Bitcoin-Qt, Bitcoin Bitcoin Core, Bitcoin Bitcoind.