Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ZMQ: Update to 4.3.1 #874

Merged
merged 1 commit into from
Feb 19, 2019
Merged

ZMQ: Update to 4.3.1 #874

merged 1 commit into from
Feb 19, 2019

Conversation

leto
Copy link
Contributor

@leto leto commented Feb 19, 2019 •
edited
Loading

Description

XVG has a vulnerable version of the dependency zeromq, and puts the users which have this feature enabled at risk for a remote-code-execution bug related to CVE-2019-6250 .

This bug can also be triggered via a malicious website talking to localhost via a browser that is on the same computer as a full node with zeromq enabled, using a "DNS rebinding attack". Many
automated tools to perform these attacks now exist, some written by Google Project Zero researchers.

Many block explorers and mining pools use zeromq and are particularly at risk. Exchanges may also have this feature enabled. This vulnerability can lead to exfiltration of private keys, loss of funds and potentially backdooring of servers.

Example Scenarios

Remote Node attack

  • Various unix user accounts exist on the same server as an instance of an XVG full node with zeromq enabled
  • Unprivileged user on the same machine as user of Insight explorer is compromised
  • User uses zeromq CVE-2019-6250 via localhost to steal wallet.dat, leave backdoor/etc

Local Node attack

  • Developer runs a development/testing version of a zeromq-enabled XVG full node on localhost
  • Developer browses to a malicious website
  • Website uses DNS rebinding attack to communicate directly with zeromq
  • Website uses zeromq CVE-2019-6250 to steal all funds and leave a backdoor/etc

Any application which uses a XVG node with zeromq enabled is vulnerable, Insight explorers are just a common and well-known example.

All versions of zeromq from 4.2.0 to 4.3.0 are vulnerable, so this Pull Request upgrades XVG to 4.3.1, bringing XVG in sync with BTC upstream.

Block explorers and mining pools should be updated with this new dependency, as well as any other applications that enable zeromq. Changing configurations to add authentication to zeromq and specifically not trust all connections from localhost is also highly encouraged.

A bounty would be greatly appreciated at this address:

D7FQXWqcnpxRuHVWH4tCJDMTJ9on2r6zGm

and will help fund my future security research in XVG.
My GPG keys can be obtained from Keybase if desired.

Thanks,
Duke Leto

Motivation and Context

Maintain the security of full nodes with zeromq enabled.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

  • My code follows the code style of this project.
  • My change requires a change to the documentation.
  • I have updated the documentation accordingly.

@justinvforvendetta justinvforvendetta merged commit 565bf43 into vergecurrency:master Feb 19, 2019
justinvforvendetta added a commit that referenced this pull request Feb 19, 2019
@justinvforvendetta
Update zeromq to 4.3.1 (#874) (#875)
c8cf8ce 
This is related to the BTC issue
bitcoin/bitcoin#15188
and CVE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6250
justinvforvendetta added a commit that referenced this pull request Feb 24, 2019
@justinvforvendetta
Develop (#878)
f78d0a8 
* Update randomized authentication for proxy connections

* Adds copyrights to torcontroller
Resolves #867

* Tor Hidden Services v3 (#872)

* Initi v3 tor hidden services

* Support hidden services (V3) for new nodes

* Remove my laziness

* Remove more logs

* Add i2p support (#873)

* add i2p support

if using i2p wrapped daemon.

it would be nice to eventually add i2pd as an option as well.

* fix shmypo

* Update zeromq to 4.3.1 (#874) (#875)

This is related to the BTC issue
bitcoin/bitcoin#15188
and CVE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6250

* [WIP] Bugfix block submission (#877)

* Remove segwits segments from block template 🥳

* Disabling Segwit components (no pre-segwit)

* Remove segwit switch from code 🧐

* Reenable version bit calculations

* Enabling Chainparams genesis block and merkle root checks

* Improve header parsing and correction for block parsing with older nodes #865 (#870)

* Update randomized authentication for proxy connections

* Adds copyrights to torcontroller
Resolves #867

* Tor Hidden Services v3 (#872)

* Initi v3 tor hidden services

* Support hidden services (V3) for new nodes

* Remove my laziness

* Remove more logs

* Add i2p support (#873)

* add i2p support

if using i2p wrapped daemon.

it would be nice to eventually add i2pd as an option as well.

* Fix testnet chain parameters

* Refactor POW a bit for more readability

* Include Blocksignatures as part of our generated blocks
(also being transferred)

* Fix pub-/privkey prefixes for testnet
justinvforvendetta added a commit that referenced this pull request Feb 24, 2019
@justinvforvendetta
Develop (#880)
0eee18b 
* Remove segwits segments from block template 🥳

* Disabling Segwit components (no pre-segwit)

* Remove segwit switch from code 🧐

* Reenable version bit calculations

* Enabling Chainparams genesis block and merkle root checks

* Update randomized authentication for proxy connections

* Adds copyrights to torcontroller
Resolves #867

* Tor Hidden Services v3 (#872)

* Initi v3 tor hidden services

* Support hidden services (V3) for new nodes

* Remove my laziness

* Remove more logs

* Add i2p support (#873)

* add i2p support

if using i2p wrapped daemon.

it would be nice to eventually add i2pd as an option as well.

* fix shmypo

* Update zeromq to 4.3.1 (#874) (#875)

This is related to the BTC issue
bitcoin/bitcoin#15188
and CVE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6250

* Improve header parsing and correction for block parsing with older nodes #865 (#870)

* Update randomized authentication for proxy connections

* Adds copyrights to torcontroller
Resolves #867

* Tor Hidden Services v3 (#872)

* Initi v3 tor hidden services

* Support hidden services (V3) for new nodes

* Remove my laziness

* Remove more logs

* Add i2p support (#873)

* add i2p support

if using i2p wrapped daemon.

it would be nice to eventually add i2pd as an option as well.

* Fix testnet chain parameters

* Refactor POW a bit for more readability

* Include Blocksignatures as part of our generated blocks
(also being transferred)

* Fix pub-/privkey prefixes for testnet

* [WIP] Bugfix block submission (#877)

* Remove segwits segments from block template 🥳

* Disabling Segwit components (no pre-segwit)

* Remove segwit switch from code 🧐

* Reenable version bit calculations

* Enabling Chainparams genesis block and merkle root checks

* Improve header parsing and correction for block parsing with older nodes #865 (#870)

* Update randomized authentication for proxy connections

* Adds copyrights to torcontroller
Resolves #867

* Tor Hidden Services v3 (#872)

* Initi v3 tor hidden services

* Support hidden services (V3) for new nodes

* Remove my laziness

* Remove more logs

* Add i2p support (#873)

* add i2p support

if using i2p wrapped daemon.

it would be nice to eventually add i2pd as an option as well.

* Fix testnet chain parameters

* Refactor POW a bit for more readability

* Include Blocksignatures as part of our generated blocks
(also being transferred)

* Fix pub-/privkey prefixes for testnet

* Remove previous invalidation schemes and replace them with our ones

* Transfer methods into cpp file rather than inline methods

* Enabling full mining capabilities

* Fix compiling issues

* Revert "Merge branch 'bench_tests' into develop"

This reverts commit 3969482, reversing
changes made to 33ce10b.
justinvforvendetta pushed a commit that referenced this pull request Feb 28, 2019
@marpme @justinvforvendetta
Back-merge develop into master (Release v5.0.0-beta) (#883)
96e1b3c 
* Remove segwits segments from block template 🥳

* Disabling Segwit components (no pre-segwit)

* Remove segwit switch from code 🧐

* Reenable version bit calculations

* Enabling Chainparams genesis block and merkle root checks

* Update randomized authentication for proxy connections

* Adds copyrights to torcontroller
Resolves #867

* Tor Hidden Services v3 (#872)

* Initi v3 tor hidden services

* Support hidden services (V3) for new nodes

* Remove my laziness

* Remove more logs

* Add i2p support (#873)

* add i2p support

if using i2p wrapped daemon.

it would be nice to eventually add i2pd as an option as well.

* fix shmypo

* Update zeromq to 4.3.1 (#874) (#875)

This is related to the BTC issue
bitcoin/bitcoin#15188
and CVE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6250

* Improve header parsing and correction for block parsing with older nodes #865 (#870)

* Update randomized authentication for proxy connections

* Adds copyrights to torcontroller
Resolves #867

* Tor Hidden Services v3 (#872)

* Initi v3 tor hidden services

* Support hidden services (V3) for new nodes

* Remove my laziness

* Remove more logs

* Add i2p support (#873)

* add i2p support

if using i2p wrapped daemon.

it would be nice to eventually add i2pd as an option as well.

* fix init/for bench

* add chain to interfaces

* add optional header

* close def

* add walletinit to makefile

* add chain header to init

* add int chain

* update rpc util

* move rawtx to node/tx

* remove header dup

* add zmq headers

* remove zmqrpc hdr

* remove unused boost deps

* add zmqrpc

* add zmq rpc to makefile

* zmqheader

* add zmqrpc to automake

* update walletiinitinterface header

* updates to node txs

* Update init.cpp

* updates

* Update strencodings.h

* add assumptions to compat

* update banman

* update addrdb

* update addrman

* update getcheaphash

* add chain interface

* update net_processing header

* updates to node interface

* updates to zmq notification interface

* update zmq abstract notifier

* update net header

* move handlers to header

* update cclientUIinterface

* clean up, remove regtest

* update logging

* update logger on http server

* isbindany

* vaddednodes

* remove dupe

* close())

* SetLimited -> SetReachable

* add argument

* add arg

* add arg

* update to net

* fixes

* update w header parsing

* update validation header

ugh

* fixes

* fix torcontrol

* loginstance

* +}-(

hue

* pita

* remove arg

* update rest api

* update blockchain rpc header

* cblockindex updates

* more cblockindex

* Fix testnet chain parameters

* Refactor POW a bit for more readability

* Include Blocksignatures as part of our generated blocks
(also being transferred)

* Fix pub-/privkey prefixes for testnet

* [WIP] Bugfix block submission (#877)

* Remove segwits segments from block template 🥳

* Disabling Segwit components (no pre-segwit)

* Remove segwit switch from code 🧐

* Reenable version bit calculations

* Enabling Chainparams genesis block and merkle root checks

* Improve header parsing and correction for block parsing with older nodes #865 (#870)

* Update randomized authentication for proxy connections

* Adds copyrights to torcontroller
Resolves #867

* Tor Hidden Services v3 (#872)

* Initi v3 tor hidden services

* Support hidden services (V3) for new nodes

* Remove my laziness

* Remove more logs

* Add i2p support (#873)

* add i2p support

if using i2p wrapped daemon.

it would be nice to eventually add i2pd as an option as well.

* Fix testnet chain parameters

* Refactor POW a bit for more readability

* Include Blocksignatures as part of our generated blocks
(also being transferred)

* Fix pub-/privkey prefixes for testnet

* Develop (#878)

* Update randomized authentication for proxy connections

* Adds copyrights to torcontroller
Resolves #867

* Tor Hidden Services v3 (#872)

* Initi v3 tor hidden services

* Support hidden services (V3) for new nodes

* Remove my laziness

* Remove more logs

* Add i2p support (#873)

* add i2p support

if using i2p wrapped daemon.

it would be nice to eventually add i2pd as an option as well.

* fix shmypo

* Update zeromq to 4.3.1 (#874) (#875)

This is related to the BTC issue
bitcoin/bitcoin#15188
and CVE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6250

* [WIP] Bugfix block submission (#877)

* Remove segwits segments from block template 🥳

* Disabling Segwit components (no pre-segwit)

* Remove segwit switch from code 🧐

* Reenable version bit calculations

* Enabling Chainparams genesis block and merkle root checks

* Improve header parsing and correction for block parsing with older nodes #865 (#870)

* Update randomized authentication for proxy connections

* Adds copyrights to torcontroller
Resolves #867

* Tor Hidden Services v3 (#872)

* Initi v3 tor hidden services

* Support hidden services (V3) for new nodes

* Remove my laziness

* Remove more logs

* Add i2p support (#873)

* add i2p support

if using i2p wrapped daemon.

it would be nice to eventually add i2pd as an option as well.

* Fix testnet chain parameters

* Refactor POW a bit for more readability

* Include Blocksignatures as part of our generated blocks
(also being transferred)

* Fix pub-/privkey prefixes for testnet

* add isbindany back to netaddress header

* update blockchain rpc

* update blockchain rpc header

* fix blockchain rpc header

* Move versionbits info out of versionbits.o

* Remove previous invalidation schemes and replace them with our ones

* Transfer methods into cpp file rather than inline methods

* Enabling full mining capabilities

* Fix compiling issues

* Revert "Merge branch 'bench_tests' into develop"

This reverts commit 3969482, reversing
changes made to 33ce10b.

* Revert "Merge branch 'bench_tests' into develop"

This reverts commit efc7e3b, reversing
changes made to b508db7.

* Fix linking issues for wallet signing

* Update README.md

* Remove the useless rest of a merge conflict 🙉
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@leto @justinvforvendetta