ghostlander Halcyon до 1.1.1.0-hal Block Verification src/main.cpp CBlock::AddToBlockIndex эскалация привилегий

Уязвимость была найдена в ghostlander Halcyon. Она была классифицирована как критический. Затронута функция CBlock::AddToBlockIndex файла src/main.cpp компонента Block Verification. Определение CWE для уязвимости следующее CWE-284. Консультация представлена на сайте github.com. Эта уязвимость известна как CVE-2021-4300. Атака может быть осуществлена удаленно. Имеются технические подробности. Эксплойт отсутствует. Текущая цена за эксплойт может составлять около USD $0-$5k в настоящее время. Проект MITRE ATT&CK использует технику атаки T1068 для этой проблемы. Объявляется Не определено. Мы ожидаем, что 0-день стоил приблизительно $0-$5k. Обновление до версии 1.1.1.0-hal способно решить эту проблему. Обновленную версию можно скачать по адресу github.com. Название патча следующее 0675b25ae9cc10b5fdc8ea3a32c642979762d45e. Исправление готово для загрузки по адресу github.com. Рекомендуется обновить затронутый компонент.

Поле04.01.2023 22:1928.01.2023 11:2328.01.2023 11:31
vendorghostlanderghostlanderghostlander
nameHalcyonHalcyonHalcyon
componentBlock VerificationBlock VerificationBlock Verification
filesrc/main.cppsrc/main.cppsrc/main.cpp
functionCBlock::AddToBlockIndexCBlock::AddToBlockIndexCBlock::AddToBlockIndex
cwe284 (эскалация привилегий)284 (эскалация привилегий)284 (эскалация привилегий)
risk222
cvss3_vuldb_avNNN
cvss3_vuldb_acLLL
cvss3_vuldb_uiNNN
cvss3_vuldb_sUUU
cvss3_vuldb_cLLL
cvss3_vuldb_iLLL
cvss3_vuldb_aLLL
cvss3_vuldb_rlOOO
cvss3_vuldb_rcCCC
identifier0675b25ae9cc10b5fdc8ea3a32c642979762d45e0675b25ae9cc10b5fdc8ea3a32c642979762d45e0675b25ae9cc10b5fdc8ea3a32c642979762d45e
urlhttps://github.com/ghostlander/Halcyon/commit/0675b25ae9cc10b5fdc8ea3a32c642979762d45ehttps://github.com/ghostlander/Halcyon/commit/0675b25ae9cc10b5fdc8ea3a32c642979762d45ehttps://github.com/ghostlander/Halcyon/commit/0675b25ae9cc10b5fdc8ea3a32c642979762d45e
nameОбновлениеОбновлениеОбновление
upgrade_version1.1.1.0-hal1.1.1.0-hal1.1.1.0-hal
upgrade_urlhttps://github.com/ghostlander/Halcyon/releases/tag/v1.1.1.0-halhttps://github.com/ghostlander/Halcyon/releases/tag/v1.1.1.0-halhttps://github.com/ghostlander/Halcyon/releases/tag/v1.1.1.0-hal
patch_name0675b25ae9cc10b5fdc8ea3a32c642979762d45e0675b25ae9cc10b5fdc8ea3a32c642979762d45e0675b25ae9cc10b5fdc8ea3a32c642979762d45e
patch_urlhttps://github.com/ghostlander/Halcyon/commit/0675b25ae9cc10b5fdc8ea3a32c642979762d45ehttps://github.com/ghostlander/Halcyon/commit/0675b25ae9cc10b5fdc8ea3a32c642979762d45ehttps://github.com/ghostlander/Halcyon/commit/0675b25ae9cc10b5fdc8ea3a32c642979762d45e
advisoryquoteBlock Verification Vulnerability Eliminated Fixed a critical vulnerability allowing to accept a proof-of-work block containing one or more coin stake transactions in addition to a valid coin base. Output values of such coin stakes were out of control.Block Verification Vulnerability Eliminated Fixed a critical vulnerability allowing to accept a proof-of-work block containing one or more coin stake transactions in addition to a valid coin base. Output values of such coin stakes were out of control.Block Verification Vulnerability Eliminated Fixed a critical vulnerability allowing to accept a proof-of-work block containing one or more coin stake transactions in addition to a valid coin base. Output values of such coin stakes were out of control.
cveCVE-2021-4300CVE-2021-4300CVE-2021-4300
responsibleVulDBVulDBVulDB
date1672786800 (04.01.2023)1672786800 (04.01.2023)1672786800 (04.01.2023)
cvss2_vuldb_avNNN
cvss2_vuldb_acLLL
cvss2_vuldb_ciPPP
cvss2_vuldb_iiPPP
cvss2_vuldb_aiPPP
cvss2_vuldb_rcCCC
cvss2_vuldb_rlOFOFOF
cvss2_vuldb_auSSS
cvss2_vuldb_eNDNDND
cvss3_vuldb_prLLL
cvss3_vuldb_eXXX
cvss2_vuldb_basescore6.56.56.5
cvss2_vuldb_tempscore5.75.75.7
cvss3_vuldb_basescore6.36.36.3
cvss3_vuldb_tempscore6.06.06.0
cvss3_meta_basescore6.36.37.5
cvss3_meta_tempscore6.06.07.4
price_0day$0-$5k$0-$5k$0-$5k
cve_assigned1672786800 (04.01.2023)1672786800 (04.01.2023)
cve_nvd_summaryA vulnerability has been found in ghostlander Halcyon and classified as critical. Affected by this vulnerability is the function CBlock::AddToBlockIndex of the file src/main.cpp of the component Block Verification. The manipulation leads to improper access controls. The attack can be launched remotely. Upgrading to version 1.1.1.0-hal is able to address this issue. The name of the patch is 0675b25ae9cc10b5fdc8ea3a32c642979762d45e. It is recommended to upgrade the affected component. The identifier VDB-217417 was assigned to this vulnerability.A vulnerability has been found in ghostlander Halcyon and classified as critical. Affected by this vulnerability is the function CBlock::AddToBlockIndex of the file src/main.cpp of the component Block Verification. The manipulation leads to improper access controls. The attack can be launched remotely. Upgrading to version 1.1.1.0-hal is able to address this issue. The name of the patch is 0675b25ae9cc10b5fdc8ea3a32c642979762d45e. It is recommended to upgrade the affected component. The identifier VDB-217417 was assigned to this vulnerability.
cvss3_nvd_avN
cvss3_nvd_acL
cvss3_nvd_prN
cvss3_nvd_uiN
cvss3_nvd_sU
cvss3_nvd_cH
cvss3_nvd_iH
cvss3_nvd_aH
cvss2_nvd_avN
cvss2_nvd_acL
cvss2_nvd_auS
cvss2_nvd_ciP
cvss2_nvd_iiP
cvss2_nvd_aiP
cvss3_cna_avN
cvss3_cna_acL
cvss3_cna_prL
cvss3_cna_uiN
cvss3_cna_sU
cvss3_cna_cL
cvss3_cna_iL
cvss3_cna_aL
cve_cnaVulDB
cvss2_nvd_basescore6.5
cvss3_nvd_basescore9.8
cvss3_cna_basescore6.3

◂ ПредыдущийОбзорДалее ▸

Interested in the pricing of exploits?

See the underground prices here!