CVE-2012-2459: Critical Vulnerability (denial-of-service)
14 May 2012

Risks

A denial-of-service vulnerability that affects all versions of bitcoind and Bitcoin-Qt has been reported and fixed. An attacker could isolate a victim's node and cause the creation of blockchain forks.

Solutions

Because this bug could be exploited to severely disrupt the Bitcoin network we consider this a critical vulnerability, and encourage everybody to upgrade to the latest version: 0.6.2.

Backports for older releases (0.5.5 and 0.4.6) are also available if you cannot upgrade to version 0.6.2.

Technical Details

Full technical details are being withheld to give people the opportunity to upgrade.

Thanks to Forrest Voight for discovering and reporting the vulnerability.

Questions & Answers

How would I know if I am the victim of this attack?

Your bitcoin process would stop processing blocks and would have a different block count from the rest of the network (you can see the current block count at websites like blockexplorer.com or blockchain.info). Eventually it would display the message:

WARNING: Displayed transactions may not be correct! You may need to upgrade, or other nodes may need to upgrade.

(note that this message is displayed whenever your bitcoin process detects that the rest of the network seems to have a different block count, which can happen for several reasons unrelated to this vulnerability).

Could this bug be used to steal my wallet?

No.

Could this bug be used to install malware on my system?

No.