CVE-2011-4447: Medium severity bitcoin vulnerability

Published Aug 6, 2012

Updated

The "encrypt wallet" feature in wxBitcoin and bitcoind 0.4.x before 0.4.1, and 0.5.0rc, does not properly interact with the deletion functionality of BSDDB, which allows context-dependent attackers to obtain unencrypted private keys from Bitcoin wallet files by bypassing the BSDDB interface and reading entries that are marked for deletion.

Affected Software

6 affected components

Bitcoin wxBitcoin=0.5.0-rc

Bitcoin wxBitcoin=0.4.0

Bitcoin wxBitcoin=0.4.1-rc6

Bitcoin Bitcoin Core=0.4.0

Bitcoin Bitcoin Core=0.4.1-rc6

Bitcoin Bitcoin Core=0.5.0-rc

Event History

Aug 6, 2012

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2011-4447?

CVE-2011-4447 is classified as a high severity vulnerability due to the potential exposure of unencrypted private keys.

How do I fix CVE-2011-4447?

To fix CVE-2011-4447, users should upgrade to the latest version of Bitcoin that addresses this vulnerability.

What versions are affected by CVE-2011-4447?

CVE-2011-4447 affects wxBitcoin and bitcoind versions 0.4.x before 0.4.1 and 0.5.0rc.

What type of attack does CVE-2011-4447 enable?

CVE-2011-4447 enables context-dependent attackers to obtain unencrypted private keys from Bitcoin wallet files.

Is my Bitcoin wallet safe from CVE-2011-4447?

If you are using an affected version of Bitcoin, your wallet is at risk until you update to a patched version.