ByteOS Network

NVD Vulnerability Details :

CVE-2018-10831

Analyzed

Source-cve@mitre.org

Published At-09 May, 2018 | 05:29

Updated At-18 Jun, 2018 | 16:46

Z-NOMP before 2018-04-05 has an incorrect Equihash solution verifier that allows attackers to spoof mining shares, as demonstrated by providing a solution with {x1=1,x2=1,x3=1,...,x512=1} to bypass this verifier for any blockheader. This originally affected (for example) the Bitcoin Gold and Zcash cryptocurrencies, and continued to be exploited in the wild in May 2018 against smaller cryptocurrencies.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Primary	2.0	5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N

CPE Matches

zclassic>>z-nomp>>Versions up to 1.0.5(inclusive)

cpe:2.3:a:zclassic:z-nomp:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-327	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://blog.zencash.com/update-for-the-equihash-mining-application-z-nomp/	cve@mitre.org	Third Party Advisory
https://github.com/edwardz246003/misc/blob/master/Attackers%20Fake%20Computational%20Power%20to%20Steal%20Cryptocurrencies%20from%20Mining%20Pools.md	cve@mitre.org	Exploit Technical Description Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History