CVE-2014-4501 Multiple stack-based buffer overflows in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 3.3.0 allow remote pool servers to have unspecified impact via a long URL in a client.reconnect...
HighCVSS 10.0
EPSS 2.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple stack-based buffer overflows in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 3.3.0 allow remote pool servers to have unspecified impact via a long URL in a client.reconnect stratum message to the (1) extract_sockaddr or (2) parse_reconnect functions in util.c.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sgminer project sgminer | <= 4.2.1 | No fix listed |
| sgminer project sgminer | = 4.0.0 | No fix listed |
| sgminer project sgminer | = 4.1.0 | No fix listed |
| sgminer project sgminer | = 4.1.153 | No fix listed |
| sgminer project sgminer | = 4.1.242 | No fix listed |
| sgminer project sgminer | = 4.1.271 | No fix listed |
| sgminer project sgminer | = 4.2.0 | No fix listed |
| cgminer project cgminer | <= 4.3.4 | No fix listed |
| cgminer project cgminer | = 4.3.0 | No fix listed |
| cgminer project cgminer | = 4.3.1 | No fix listed |
| cgminer project cgminer | = 4.3.2 | No fix listed |
| cgminer project cgminer | = 4.3.3 | No fix listed |
| bfgminer | <= 3.2.9 | No fix listed |
| bfgminer | = 3.2.0 | No fix listed |
| bfgminer | = 3.2.1 | No fix listed |
| bfgminer | = 3.2.2 | No fix listed |
| bfgminer | = 3.2.3 | No fix listed |
| bfgminer | = 3.2.4 | No fix listed |
| bfgminer | = 3.2.5 | No fix listed |
| bfgminer | = 3.2.6 | No fix listed |
| bfgminer | = 3.2.7 | No fix listed |
| bfgminer | = 3.2.8 | No fix listed |
References
- 20140722 CVE-2014-4501 : Stack Overflow in Parsing client.reconnect Message of the Stratum Mining Protocol mailing-list
- github.com exploit patch
- github.com patch
- github.com exploit patch
- github.com patch