CVE-2014-4502 Multiple heap-based buffer overflows in the parse_notify function in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 4.1.0 allow remote pool servers to have unspecified impact via a (1...
HighCVSS 10.0
EPSS 3.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple heap-based buffer overflows in the parse_notify function in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 4.1.0 allow remote pool servers to have unspecified impact via a (1) large or (2) negative value in the Extranonc2_size parameter in a mining.subscribe response and a crafted mining.notify request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bfgminer | <= 4.0.0 | No fix listed |
| bfgminer | <= 3.2.9 | No fix listed |
| bfgminer | = 3.2.0 | No fix listed |
| bfgminer | = 3.2.1 | No fix listed |
| bfgminer | = 3.2.2 | No fix listed |
| bfgminer | = 3.2.3 | No fix listed |
| bfgminer | = 3.2.4 | No fix listed |
| bfgminer | = 3.2.5 | No fix listed |
| bfgminer | = 3.2.6 | No fix listed |
| bfgminer | = 3.2.7 | No fix listed |
| bfgminer | = 3.2.8 | No fix listed |
| sgminer project sgminer | <= 4.2.1 | No fix listed |
| sgminer project sgminer | = 4.0.0 | No fix listed |
| sgminer project sgminer | = 4.1.0 | No fix listed |
| sgminer project sgminer | = 4.1.153 | No fix listed |
| sgminer project sgminer | = 4.1.242 | No fix listed |
| sgminer project sgminer | = 4.1.271 | No fix listed |
| sgminer project sgminer | = 4.2.0 | No fix listed |
References
- 20140722 CVE-2014-4502 : Invalid Handling of Length Parameter in Stratum mining.notify Message Leads to Heap Overflow mailing-list
- 68831 vdb-entry
- github.com exploit patch
- github.com exploit patch
- github.com exploit patch
- github.com