{"id":"CVE-2015-6964","state":"PUBLISHED","title":"MultiBit HD before 0.1.2 allows attackers to conduct bit-flipping attacks that insert unspendable Bitcoin addresses into the list that MultiBit uses to send fees to the developers.","description":"MultiBit HD before 0.1.2 allows attackers to conduct bit-flipping attacks that insert unspendable Bitcoin addresses into the list that MultiBit uses to send fees to the developers. (Attackers cannot realistically steal these fees for themselves.) This occurs because there is no message authentication code (MAC).","publishedAt":"2023-09-25T00:00:00.000Z","updatedAt":"2024-09-24T17:39:24.320Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"CISA-ADP"},"assigner":"mitre","products":["n/a n/a"],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":["https://web.archive.org/web/20160506095434/https://multibit.org/blog/2015/07/25/bit-flipping-attack.html"],"weaknesses":["CWE-697"],"ingestedAt":"2026-10-29T19:42:12.437Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2015/6xxx/CVE-2015-6964.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2015-6964","state":"PUBLISHED","datePublished":"2023-09-25T00:00:00.000Z","dateUpdated":"2024-09-24T17:39:24.320Z","assignerShortName":"mitre","assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","dateReserved":"2015-09-16T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"MultiBit HD before 0.1.2 allows attackers to conduct bit-flipping attacks that insert unspendable Bitcoin addresses into the list that MultiBit uses to send fees to the developers. (Attackers cannot realistically steal these fees for themselves.) This occurs because there is no message authentication code (MAC)."}],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":[{"url":"https://web.archive.org/web/20160506095434/https://multibit.org/blog/2015/07/25/bit-flipping-attack.html"}],"problemTypes":[{"descriptions":[{"type":"text","lang":"en","description":"n/a"}]}],"providerMetadata":{"shortName":"mitre","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","dateUpdated":"2023-09-25T04:46:54.730Z"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://web.archive.org/web/20160506095434/https://multibit.org/blog/2015/07/25/bit-flipping-attack.html","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-06T07:36:34.885Z"}},{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"multibit","product":"multibit_hd","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"0.1.2","versionType":"custom"}],"cpes":["cpe:2.3:a:multibit:multibit_hd:-:*:*:*:*:*:*:*"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-09-24T17:38:22.096019Z","id":"CVE-2015-6964","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-697","type":"CWE","lang":"en","description":"CWE-697 Incorrect Comparison"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-24T17:39:24.320Z"}}]}}}