<p>The 0.3.7 update does indeed fix the script execution bug that is being described, the vulnerable code below is removed and replaced with functions that execute the scriptSig and then the scriptPubKey on the same stack. </p>

<pre><code>if (!EvalScript(txin.scriptSig + CScript(OP_CODESEPARATOR) + txout.scriptPubKey, txTo, nIn))
</code></pre>

<p>Previously what would happen is that the two script tapes were literally concatenated, then executed as one. The problem here is simply that we can use a trailing <code>OP_PUSHDATA</code> in the <code>scriptSig</code> push the entire <code>scriptPubKey</code> to the stack as a single data element rather than discrete opcodes. Our <code>scriptSig</code> would simply be a push opcode for the length of the <code>scriptPubKey</code> plus an <code>OP_CODESEPERATOR</code>. At the end of execution the only element remaining on the stack is not zero, so the evaluation returns true and we can spend any coins we like. </p>

CC BY-SA 4.0
2020-09-18T09:59:38.253Z
So the change allow only some standard scripts is not related to the issue?
user2284570
CC BY-SA 3.0
2015-09-15T13:03:30.900Z
2015-09-15T13:03:30.900Z
Claris
<p><a href="https://bitcointalk.org/index.php?topic=152470.msg1620493#msg1620493">This post by Mike Hearn</a> relates an interesting bit of history:</p>

<blockquote>
  <p>When Bitcoin was first released, it contained two completely fatal bugs that made the entire system worthless. Fortunately, they were found and fixed before Bitcoin  actually had any serious value.</p>
  
  <p>The first bug was that scripts were concatenated before being run instead of just using a shared stack. This meant that anyone could write a scriptSig that always evaluated to true and claim anyone elses coins. Fixed here in v0.3.2:</p>
  
  <p><a href="https://github.com/bitcoin/bitcoin/commit/73aa262647ff9948eaf95e83236ec323347e95d0">https://github.com/bitcoin/bitcoin/commit/73aa262647ff9948eaf95e83236ec323347e95d0</a></p>
</blockquote>

<p>However, the link appears to point to the <a href="https://github.com/bitcoin/bitcoin/commit/73aa262647ff9948eaf95e83236ec323347e95d0">0.3.7 update</a>.</p>

<p>Looking at the diff, this update does appear to change the script interpreter in the way Mike outlined.</p>

<p>A search turned up very little on the 0.3.7 update. One hit was <a href="https://bitcointalk.org/index.php?topic=664.0">this question</a>, which generated no responses:</p>

<blockquote>
  <p>I noticed that 0.3.7 is released on the website, but after searching the forums I can't find any information on what the changes are.  Never mind that the changes from version to version should be packaged with the download....</p>
  
  <p>anyone care to clue me in on this one?</p>
</blockquote>

<p><a href="https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2010-5141">The CVE page</a>, however, makes this claim:</p>

<blockquote>
  <p>On July 28 2010, two bugs were discovered and demonstrated on the test network. One exploited a bug in the transaction handling code and allowed an attacker to spend coins that they did not own. This was never exploited on the main network, and was fixed by Bitcoin version 0.3.5.</p>
</blockquote>

<p>So, depending on the source you use, the release that fixed the bug was 0.3.2, 0.3.5, or 0.3.7.</p>

<p>Given that this was one of the worst bugs in Bitcoin's history, it seems like the documentation should be more consistent. Can someone point me to other sources that might help clear things up?</p>

<script><attack><cve-2010-5141>
Which release fixed CVE-2010-5141 (attacker can spend any coin)
Rich Apodaca
# Which release fixed CVE-2010-5141 (attacker can spend any coin)

(Asked by: username_0 on 2015-05-14)

[This post by Mike Hearn](https://bitcointalk.org/index.php?topic=152470.msg1620493#msg1620493) relates an interesting bit of history:

> When Bitcoin was first released, it contained two completely fatal bugs that made the entire system worthless. Fortunately, they were found and fixed before Bitcoin actually had any serious value.
>
> The first bug was that scripts were concatenated before being run instead of just using a shared stack. This meant that anyone could write a scriptSig that always evaluated to true and claim anyone elses coins. Fixed here in v0.3.2:
>
> <https://github.com/bitcoin/bitcoin/commit/73aa262647ff9948eaf95e83236ec323347e95d0>

However, the link appears to point to the [0.3.7 update](https://github.com/bitcoin/bitcoin/commit/73aa262647ff9948eaf95e83236ec323347e95d0).

Looking at the diff, this update does appear to change the script interpreter in the way Mike outlined.

A search turned up very little on the 0.3.7 update. One hit was [this question](https://bitcointalk.org/index.php?topic=664.0), which generated no responses:

> I noticed that 0.3.7 is released on the website, but after searching the forums I can't find any information on what the changes are. Never mind that the changes from version to version should be packaged with the download....
>
> anyone care to clue me in on this one?

[The CVE page](https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2010-5141), however, makes this claim:

> On July 28 2010, two bugs were discovered and demonstrated on the test network. One exploited a bug in the transaction handling code and allowed an attacker to spend coins that they did not own. This was never exploited on the main network, and was fixed by Bitcoin version 0.3.5.

So, depending on the source you use, the release that fixed the bug was 0.3.2, 0.3.5, or 0.3.7.

Given that this was one of the worst bugs in Bitcoin's history, it seems like the documentation should be more consistent. Can someone point me to other sources that might help clear things up?

**Tags:** script, attack, cve-2010-5141


---

## 1 answers

### Answer by username_1 on 2015-09-15. Score: 5

The 0.3.7 update does indeed fix the script execution bug that is being described, the vulnerable code below is removed and replaced with functions that execute the scriptSig and then the scriptPubKey on the same stack.

```
if (!EvalScript(txin.scriptSig + CScript(OP_CODESEPARATOR) + txout.scriptPubKey, txTo, nIn))

```

Previously what would happen is that the two script tapes were literally concatenated, then executed as one. The problem here is simply that we can use a trailing `OP_PUSHDATA` in the `scriptSig` push the entire `scriptPubKey` to the stack as a single data element rather than discrete opcodes. Our `scriptSig` would simply be a push opcode for the length of the `scriptPubKey` plus an `OP_CODESEPERATOR`. At the end of execution the only element remaining on the stack is not zero, so the evaluation returns true and we can spend any coins we like.

> **Comments:**
> **username_2**: So the change allow only some standard scripts is not related to the issue?  

---

