KronosSlott
  • Altcoin
  • Bitcoin
  • Blockchain
  • Ethereum
  • Litecoin
  • Gambling

Subscribe to Updates

Get the latest Crypto news from kronosslott.

What's Hot

Optimism OP Price Prediction: Will It Break The $3.48 Resistance?

February 4, 2023

BTC Price Is in a Range as It Pauses Above $23K Support

February 4, 2023

Bloktopia Metaverse Crypto Pumping New Land BLOK NFTs – RobotEra Presale Stronger Potential?

February 4, 2023
Facebook Twitter Instagram
  • Affiliate Disclosure
  • Anti Spam Policy
  • Cookie Policy
  • Privacy Policy
  • Terms & Conditions
Facebook Twitter Instagram
KronosSlott
  • Altcoin
  • Bitcoin
  • Blockchain
  • Ethereum
  • Litecoin
  • Gambling
KronosSlott
Home » Security Alert – Mist can be vulnerable when navigating to malicious DApps

Security Alert – Mist can be vulnerable when navigating to malicious DApps

adminBy adminOctober 11, 2022No Comments2 Mins Read
Facebook Twitter Pinterest LinkedIn Tumblr Reddit Telegram Email
The Devcon VI Manual | Ethereum Foundation Blog
Share
Facebook Twitter LinkedIn Pinterest Email


Mist leaks some low level APIs, which Dapps could use to gain access to the computer’s file system and read/delete files. This would only affect you if you navigate to an untrusted Dapp that knows about these vulnerabilities and specifically tries to attack users. Upgrading Mist is highly recommended to prevent exposure to attacks.

Affected configurations: All versions of Mist from 0.8.6 and lower. This vulnerability doesn’t affect the Ethereum Wallet since it can’t load external DApps.
Likelihood: Medium
Severity: High

Summary

Some Mist API methods were exposed, making it possible for malicious webpages to gain access to a privileged interface that could delete files on the local filesystem or launch registered protocol handlers and obtain sensitive information, such as the user directory or the user’s “coinbase”.
Vulnerable exposed mist APIs:

mist.shell

mist.dirname

mist.syncMinimongo

web3.eth.coinbase

is now

null

, if the account is not allowed for the dapp

Solution

Upgrade to the latest version of the Mist Browser. Do not use any previous Mist versions to navigate to any untrusted webpage, or local webpages from unknown origins. The Ethereum Wallet is not affected as it doesn’t allow navigation to external pages.
This is a good reminder that Mist is currently only considered for Ethereum App Development and should not be used for end users to navigate on the open web until it has reached at least version 1.0. An external audit of Mist is scheduled for December.

A big thanks goes to @tintinweb for his very useful reproduction app to test the vulnerabilities!

We are also thinking of adding Mist to the bounty program, if you find vulnerabilities or severe bugs please contract us at bounty@ethereum.org




Source link

Share. Facebook Twitter Pinterest LinkedIn Tumblr Email
admin
  • Website

Related Posts

Grantee Roundup – Q1 2023

February 3, 2023

EF-Supported Teams: Research & Development Roundup

December 29, 2022

KZG Ceremony Grant Round | Ethereum Foundation Blog

December 15, 2022

Comments are closed.

Don't Miss

Optimism OP Price Prediction: Will It Break The $3.48 Resistance?

Blockchain February 4, 2023

Join Our Telegram channel to stay up to date on breaking news coverage Optimism (OP)…

BTC Price Is in a Range as It Pauses Above $23K Support

February 4, 2023

Bloktopia Metaverse Crypto Pumping New Land BLOK NFTs – RobotEra Presale Stronger Potential?

February 4, 2023

Biggest Crypto Gainers Today – February 3

February 4, 2023
Stay In Touch
  • Facebook
  • Twitter
  • Pinterest
  • Instagram
  • YouTube
  • Vimeo
Our Picks

Optimism OP Price Prediction: Will It Break The $3.48 Resistance?

February 4, 2023

BTC Price Is in a Range as It Pauses Above $23K Support

February 4, 2023

Bloktopia Metaverse Crypto Pumping New Land BLOK NFTs – RobotEra Presale Stronger Potential?

February 4, 2023

Biggest Crypto Gainers Today – February 3

February 4, 2023

Subscribe to Updates

Get the latest Crypto news from kronosslott.

About Us
About Us

Your source for the serious news. This website is crafted specifically to for crazy and hot cryptonews. Visit our main page for more tons of news.

We're social. Connect with us:

Facebook Twitter Pinterest YouTube WhatsApp
Categories
  • Altcoin (4)
  • Bitcoin (2,020)
  • Blockchain (840)
  • Ethereum (321)
  • Gambling (2,082)
  • Litecoin (59)
  • NFTs (2)
Our Picks

Optimism OP Price Prediction: Will It Break The $3.48 Resistance?

February 4, 2023

BTC Price Is in a Range as It Pauses Above $23K Support

February 4, 2023

Bloktopia Metaverse Crypto Pumping New Land BLOK NFTs – RobotEra Presale Stronger Potential?

February 4, 2023
©2022 –Kronosslott. All Rights Reserved. Kronosslott.com is an independent i-Gaming news site and casino comparison service. Every effort is made to ensure that the bonus offers listed here are accurate and up-to-date. However, we accept no responsibility for inaccuracies or errors. It is your responsibility to confirm the terms of any promotion you choose to accept. Looking to Advertise with us? Kronosslott is always looking for new partnerships. To Inquire please email kronosslott@gmail.com

Type above and press Enter to search. Press Esc to cancel.