PT-2017-14640 · Claymore · Claymore Dual Gpu Miner

Tintinweb · Publicado 2017-12-05 · Atualizado 2017-12-21 · CVE-2017-16929

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Claymore Dual GPU miner version 10.1

Description The remote management interface is vulnerable to an authenticated directory traversal issue. This can be exploited by issuing a specially crafted request, allowing a remote attacker to read or write arbitrary files. The issue can be triggered via ../ sequences in the pathname to miner file or miner getfile.

Recommendations For Claymore Dual GPU miner version 10.1, consider restricting access to the remote management interface until a fix is available. As a temporary workaround, avoid using the miner file or miner getfile parameters in the affected API endpoint to minimize the risk of exploitation.

Exploit

Correção

Buffer Overflow

Path traversal

Enumeração de Fraquezas

CWE-119

CWE-22

Identificadores relacionados

CVE-2017-16929

Produtos afetados

Claymore Dual Gpu Miner

Referências · 5

• 🔥 https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-16929 · Exploit
• 🔥 https://exploit-db.com/exploits/43231 · Exploit
• http://openwall.com/lists/oss-security/2017/12/04/3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-16929 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-16929 · Aviso do Fabricante