PT-2017-14640 · Claymore · Claymore Dual Gpu Miner

Tintinweb · Published 2017-12-05 · Updated 2017-12-21 · CVE-2017-16929

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Claymore Dual GPU miner version 10.1

Description The remote management interface is vulnerable to an authenticated directory traversal issue. This can be exploited by issuing a specially crafted request, allowing a remote attacker to read or write arbitrary files. The issue can be triggered via ../ sequences in the pathname to miner file or miner getfile.

Recommendations For Claymore Dual GPU miner version 10.1, consider restricting access to the remote management interface until a fix is available. As a temporary workaround, avoid using the miner file or miner getfile parameters in the affected API endpoint to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Path traversal

Weakness Enumeration

CWE-119

CWE-22

Related Identifiers

CVE-2017-16929

Affected Products

Claymore Dual Gpu Miner

References · 5

• 🔥 https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-16929 · Exploit
• 🔥 https://exploit-db.com/exploits/43231 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-16929 · Security Note
• https://osv.dev/vulnerability/CVE-2017-16929 · Vendor Advisory
• http://openwall.com/lists/oss-security/2017/12/04/3 · Note