PT-2017-13978 · Ewbf · Ewbf Cuda Zcash Miner

Published 2017-10-15 · Updated 2019-10-03 · CVE-2017-15300

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions EWBF Cuda Zcash Miner version 0.3.4b

Description The issue concerns the miner statistics HTTP API, which can be exploited for a Denial of Service attack. This occurs because the API hangs on incoming TCP connections until a request is made, such as "GET / HTTP/1.1". An attacker can prevent a user from viewing their mining statistics by opening a session with tools like telnet or netcat and connecting to the miner on the HTTP API port.

Recommendations For EWBF Cuda Zcash Miner version 0.3.4b, as a temporary workaround, consider restricting access to the miner statistics HTTP API to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2017-15300

Affected Products

Ewbf Cuda Zcash Miner

References · 4

• https://osv.dev/vulnerability/CVE-2017-15300 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15300 · Security Note
• https://legacysecuritygroup.com/cve-2017-15300.html · Note
• https://bitcointalk.org/index.php?topic=1707546.msg23016970#msg23016970 · Note