PT-2014-5936 · Con Kolivas · Sgminer+1

Mick Ayzenberg · Publicado 2014-07-23 · Atualizado 2014-07-23 · CVE-2014-4503

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions sgminer versions prior to 4.2.2 cgminer versions 3.3.0 through 4.0.1

Description The issue allows man-in-the-middle attackers to cause a denial of service, resulting in application exit. This can be achieved by sending a crafted mining.notify action stratum message with malicious parameters, including bbversion, prev hash, nbit, or ntime.

Recommendations For sgminer versions prior to 4.2.2, update to version 4.2.2 or later. For cgminer versions 3.3.0 through 4.0.1, consider disabling the parse notify function in util.c as a temporary workaround until a patch is available. Restrict access to the mining.notify action stratum message to minimize the risk of exploitation. Avoid using the parameters bbversion, prev hash, nbit, or ntime in the affected API endpoint until the issue is resolved.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2014-4503

Produtos afetados

Cgminer

Sgminer

Referências · 3

• 🔥 https://github.com/sgminer-dev/sgminer/commit/910c36089940e81fb85c65b8e63dcd2fac71470c · Exploit
• http://seclists.org/fulldisclosure/2014/Jul/120 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-4503 · Nota de Segurança