PT-2018-17472 · Claymore · Claymore Dual Gpu Miner

Res1N · Published 2018-02-02 · Updated 2018-02-15 · CVE-2018-6317

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Claymore Dual Miner versions 10.5 and earlier

Description The remote management interface is vulnerable to an unauthenticated format string issue, allowing remote attackers to read memory or cause a denial of service.

Recommendations For Claymore Dual Miner versions 10.5 and earlier, update to a version later than 10.5 to resolve the issue.

Exploit

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2018-6317

Affected Products

Claymore Dual Gpu Miner

References · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/tcp/claymore_dos.py · Exploit
• 🔥 https://exploit-db.com/exploits/43972 · Exploit
• 🔥 https://medium.com/secjuice/claymore-dual-gpu-miner-10-5-format-strings-vulnerability-916ab3d2db30 · Exploit
• 🔥 https://medium.com/@res1n/claymore-dual-gpu-miner-10-5-format-strings-vulnerability-916ab3d2db30 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-6317 · Security Note
• https://osv.dev/vulnerability/CVE-2018-6317 · Vendor Advisory
• https://medium.com/%40res1n/claymore-dual-gpu-miner-10-5-format-strings-vulnerability-916ab3d2db30 · Note