A vulnerability, which was classified as problematic, has been found in Libbitcoin Explorer up to 3.6.0. This issue affects an unknown part. The manipulation with an unknown input leads to a entropy vulnerability. Using CWE to declare the problem leads to CWE-331. The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others. Impacted is confidentiality. The summary by CVE is:

The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue. The use of an mt19937 Mersenne Twister PRNG restricts the internal entropy to 32 bits regardless of settings. This allows remote attackers to recover any wallet private keys generated from "bx seed" entropy output and steal funds. (Affected users need to move funds to a secure new cryptocurrency wallet.) NOTE: the vendor's position is that there was sufficient documentation advising against "bx seed" but others disagree. NOTE: this was exploited in the wild in June and July 2023.

The weakness was presented 08/09/2023. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2023-39910 since 08/07/2023. Technical details are unknown but an exploit is available. The attack technique deployed by this issue is T1600.001 according to MITRE ATT&CK.

It is declared as highly functional.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Productinfo

Vendor

• Libbitcoin

Name

• Explorer

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion