This post by Mike Hearn relates an interesting bit of history:
When Bitcoin was first released, it contained two completely fatal bugs that made the entire system worthless. Fortunately, they were found and fixed before Bitcoin actually had any serious value.
The first bug was that scripts were concatenated before being run instead of just using a shared stack. This meant that anyone could write a scriptSig that always evaluated to true and claim anyone elses coins. Fixed here in v0.3.2:
However, the link appears to point to the 0.3.7 update.
Looking at the diff, this update does appear to change the script interpreter in the way Mike outlined.
A search turned up very little on the 0.3.7 update. One hit was this question, which generated no responses:
I noticed that 0.3.7 is released on the website, but after searching the forums I can't find any information on what the changes are. Never mind that the changes from version to version should be packaged with the download....
anyone care to clue me in on this one?
The CVE page, however, makes this claim:
On July 28 2010, two bugs were discovered and demonstrated on the test network. One exploited a bug in the transaction handling code and allowed an attacker to spend coins that they did not own. This was never exploited on the main network, and was fixed by Bitcoin version 0.3.5.
So, depending on the source you use, the release that fixed the bug was 0.3.2, 0.3.5, or 0.3.7.
Given that this was one of the worst bugs in Bitcoin's history, it seems like the documentation should be more consistent. Can someone point me to other sources that might help clear things up?