Ethereum Blog

Security Alert – Geth suffers from a very low probable DoS attack vector – Update immediately

Introduction

user

Jeffrey Wilcke


LATEST POSTS

The Ethereum network is currently undergoing a DoS attack 22nd September, 2016

Security alert – All geth nodes crash due to an out of memory bug 18th September, 2016

Security

Security Alert – Geth suffers from a very low probable DoS attack vector – Update immediately

Posted on .

Affected configurations: All Go client versions 

Likelihood: Very low

Severity: High

Details: A bug in Geth (and potentially other clients) may suffer from a DoS attack and allows remote attackers to stall synchronisation process almost indefinitely by supplying a valid, lighter chain. More information will be given out a later time including the report that was submitted through the bug bounty program.

Effects on expected chain reorganisation depth: None

Proposed temporary workaround: None

Remedial action taken by Ethereum: Provision of hotfixes as below:

If you’re using Mist: download the updated binary from the release page

If using the PPA: sudo apt-get update then sudo apt-get upgrade

If using brew: brew update then brew reinstall ethereum

If using a windows binary: download the updated binary from the release page

If you are building from source: git pull followed by make geth (please use the Master branch 94ad694a26ca3f7776ec8240802596755e5d5c0a)

profile

Jeffrey Wilcke

Comments
user

Author Stephan Tual

Posted at 6:44 pm May 17, 2016.

Thanks for the heads up and prompt fix!

Reply
user

Author Klo

Posted at 7:21 pm May 17, 2016.

Thanks for the Mist update aswell

Reply
user

Author Nicholas Spies

Posted at 1:19 am May 20, 2016.

has this been fixed? I’ve been downloading for 5 days. The update seemed to work briefly but back to super slowness. Also ‘blocks left’ switches between around 50,000 and 600,000. Think I’m still being DoS’ed. Was hoping to buy some DAO tokens but will miss out at this rate.

Reply
    user

    Author Nicholas Spies

    Posted at 1:56 pm May 25, 2016.

    Still downloading.

    Reply
      user

      Author Nelson

      Posted at 11:27 pm May 25, 2016.

      I was on the same situation. But you can always use shapeshift to buy DAO tokens with bitcoin. That’s what I did.

      Reply
        user

        Author Nicholas Spies

        Posted at 1:02 am May 26, 2016.

        Really? The DAO page says not to buy from an exchange but from a wallet. I figured that this is because in addition to your public key you will need your private key to access your tokens in future. I was tempted to buy from a kryptokit wallet but it is in beta and says not to use large amounts just in case.

        Reply
          user

          Author Nelson

          Posted at 5:18 am May 26, 2016.

          It states not to send from any exchange just because of what you say and that is correct. You need to have the private key in order to “own” the account. But if you follow the wizard at the DAO website, you’ll see that there’s an option to use shapeshift to buy DAO tokens. You’ll also see that in doing so, it asks you for your account address. I guess it sends the ethereum on your behalf by using the information provided in your public address.

          user

          Author Nicholas Spies

          Posted at 5:59 am May 26, 2016.

          For reals? Wow. Wish I did that before. Thanks very much for the tip!

          user

          Author Nelson

          Posted at 9:51 pm May 26, 2016.

          You can still buy DAO tokens. Now if you don’t want to spend some extra money buying bitcoins for that, and instead want to use ETH that you already own but are kind of frozen on your private wallet because of the sync delay, you can also check MyEtherWallet (https://www.myetherwallet.com/). They have this offline transaction feature that I just used to move some funds a couple of days ago.

          user

          Author Nicholas Spies

          Posted at 8:45 am May 28, 2016.

          I managed to get few – thanks to your suggestion to go via shapeshift. 🙂

user

Author AU

Posted at 10:22 am May 20, 2016.

Downloaded OS X 0.7.4 release but it shows Geth 1.3.6 on Develop->Ethereum Node menu.
GitHub release page https://github.com/ethereum/mist/releases/tag/0.7.4 says it should come with Geth 1.4.
Why is this?

Reply
    user

    Author CMC

    Posted at 2:02 am May 28, 2016.

    I have the exact same issue. I’m also on OS X, and mine also shows geth 1.3.6. Is this an OS X specific issue?

    Reply
user

Author Chris Mottes

Posted at 1:09 pm June 2, 2016.

Practical question from non-techie – I have vers 0.72 installed now on my Mac and I have currency in the wallet – how do I update safely?

Sorry for the practical question, have not been able to find an answer anywhere….

Reply
user

Author veox

Posted at 4:10 am July 16, 2016.

(Deleted comment – wrong thread.)

Reply

Leave a Reply

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

View Comments (14) ...
Navigation