PT-2014-5936 · Con Kolivas · Sgminer+1

Mick Ayzenberg · Published 2014-07-23 · Updated 2014-07-23 · CVE-2014-4503

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions sgminer versions prior to 4.2.2 cgminer versions 3.3.0 through 4.0.1

Description The issue allows man-in-the-middle attackers to cause a denial of service, resulting in application exit. This can be achieved by sending a crafted mining.notify action stratum message with malicious parameters, including bbversion, prev hash, nbit, or ntime.

Recommendations For sgminer versions prior to 4.2.2, update to version 4.2.2 or later. For cgminer versions 3.3.0 through 4.0.1, consider disabling the parse notify function in util.c as a temporary workaround until a patch is available. Restrict access to the mining.notify action stratum message to minimize the risk of exploitation. Avoid using the parameters bbversion, prev hash, nbit, or ntime in the affected API endpoint until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-4503

Affected Products

Cgminer

Sgminer

References · 3

• 🔥 https://github.com/sgminer-dev/sgminer/commit/910c36089940e81fb85c65b8e63dcd2fac71470c · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-4503 · Security Note
• http://seclists.org/fulldisclosure/2014/Jul/120 · Note