Geth客户端版本遭受低概率拒绝服务攻击,Ethereum发布修复补丁
Security Alert – Geth suffers from a very low probable DoS attack vector - Update immediately
Ethereum官方发布安全警报,指出Geth客户端版本存在低概率的拒绝服务攻击漏洞,攻击者可通过提供有效且较轻的链来几乎无限期地阻止同步过程。Ethereum已提供修复补丁,用户需下载更新版本以解决此问题。
Affected configurations: All Go client versions
Likelihood: Very low
Severity: High
Details: A bug in Geth (and potentially other clients) may suffer from a DoS attack and allows remote attackers to stall synchronisation process almost indefinitely by supplying a valid, lighter chain. More information will be given out a later time including the report that was submitted through the bug bounty program.
Effects on expected chain reorganisation depth: None
Proposed temporary workaround: None
Remedial action taken by Ethereum: Provision of hotfixes as below:
If you're using Mist: download the updated binary from the release page
If using the PPA: sudo apt-get update then sudo apt-get upgrade
If using brew: brew update then brew reinstall ethereum
If using a windows binary: download the updated binary from the release page
If you are building from source: git pull followed by make geth (please use the Master branch 94ad694a26ca3f7776ec8240802596755e5d5c0a)
来源:Ethereum Blog · blog.ethereum.org