CVE-2018-10376

An integer overflow in the transferProxy function of a smart contract implementation for SmartMesh (aka SMT), an Ethereum ERC20 token, allows attackers to accomplish an unauthorized increase of digital assets via crafted _fee and _value parameters, as exploited in the wild in April 2018, aka the "proxyOverflow" issue.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://dasp.co/#item-3	Not Applicable
https://peckshield.com/2018/04/25/proxyOverflow/	Exploit Third Party Advisory
https://www.reddit.com/r/ethereum/comments/8esyg9/okex_erc20_bug/	Exploit Third Party Advisory
https://dasp.co/#item-3	Not Applicable
https://peckshield.com/2018/04/25/proxyOverflow/	Exploit Third Party Advisory
https://www.reddit.com/r/ethereum/comments/8esyg9/okex_erc20_bug/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:smartmesh:smartmesh:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-04-25 09:29

Updated : 2024-11-21 03:41

NVD link : CVE-2018-10376

Mitre link : CVE-2018-10376

CVE.ORG link : CVE-2018-10376

JSON object : View

Products Affected

smartmesh

smartmesh

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2018-10376", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": true, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2018-04-25T09:29:00.707", "references": [{"url": "https://dasp.co/#item-3", "tags": ["Not Applicable"], "source": "cve@mitre.org"}, {"url": "https://peckshield.com/2018/04/25/proxyOverflow/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.reddit.com/r/ethereum/comments/8esyg9/okex_erc20_bug/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://dasp.co/#item-3", "tags": ["Not Applicable"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://peckshield.com/2018/04/25/proxyOverflow/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.reddit.com/r/ethereum/comments/8esyg9/okex_erc20_bug/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "An integer overflow in the transferProxy function of a smart contract implementation for SmartMesh (aka SMT), an Ethereum ERC20 token, allows attackers to accomplish an unauthorized increase of digital assets via crafted _fee and _value parameters, as exploited in the wild in April 2018, aka the \"proxyOverflow\" issue."}, {"lang": "es", "value": "Un desbordamiento de enteros en la funci\u00f3n transferProxy de una implementaci\u00f3n de contrato inteligente SmartMesh (SMT), un token de Ethereum ERC20, permite que atacantes logren un aumento no autorizado de los activos digitales mediante los par\u00e1metros manipulados _fee y _value, tal y como se explot\u00f3 \"in the wild\" en abril de 2018. Este problema tambi\u00e9n se conoce como \"proxyOverflow\"."}], "lastModified": "2024-11-21T03:41:17.767", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:smartmesh:smartmesh:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BBF19213-D3B8-443E-AFDE-6E5339F899C0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}