CVE-2014-4502

Published: Jul 23, 2014Modified: May 6, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Multiple heap-based buffer overflows in the parse_notify function in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 4.1.0 allow remote pool servers to have unspecified impact via a (1) large or (2) negative value in the Extranonc2_size parameter in a mining.subscribe response and a crafted mining.notify request.

Affected (18)

Products: Bfgminer: Bfgminer · Sgminer Project: Sgminer

1 product

Sgminer Project

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Bfgminer Bfgminer	version ≤ 4.0.0

Configuration B

7 vulnerable

Vulnerable Software	Affected Versions
Sgminer Project Sgminer	version ≤ 4.2.1
Sgminer Project Sgminer	Version 4.0.0
Sgminer Project Sgminer	Version 4.1.0
Sgminer Project Sgminer	Version 4.1.153
Sgminer Project Sgminer	Version 4.1.242
Sgminer Project Sgminer	Version 4.1.271
Sgminer Project Sgminer	Version 4.2.0

Configuration C

10 vulnerable

Vulnerable Software	Affected Versions
Bfgminer Bfgminer	version ≤ 3.2.9
Bfgminer Bfgminer	Version 3.2.0
Bfgminer Bfgminer	Version 3.2.1
Bfgminer Bfgminer	Version 3.2.2
Bfgminer Bfgminer	Version 3.2.3
Bfgminer Bfgminer	Version 3.2.4
Bfgminer Bfgminer	Version 3.2.5
Bfgminer Bfgminer	Version 3.2.6
Bfgminer Bfgminer	Version 3.2.7
Bfgminer Bfgminer	Version 3.2.8

Related CWEs

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (12)

http://seclists.org/fulldisclosure/2014/Jul/119

Source: cve@mitre.org

http://www.securityfocus.com/bid/68831

Source: cve@mitre.org

https://github.com/ckolivas/cgminer/commit/e1c5050734123973b99d181c45e74b2cbb00272e

Source: cve@mitre.org

ExploitPatch

https://github.com/luke-jr/bfgminer/commit/ff7f30129f15f7a2213f8ced0cd65c9a331493d9

Source: cve@mitre.org

ExploitPatch

https://github.com/sgminer-dev/sgminer/commit/bac5831b355f916e0696b7bbcccfc51c057b729a

Source: cve@mitre.org

ExploitPatch

https://github.com/sgminer-dev/sgminer/issues/258

Source: cve@mitre.org

http://seclists.org/fulldisclosure/2014/Jul/119

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/68831

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/ckolivas/cgminer/commit/e1c5050734123973b99d181c45e74b2cbb00272e

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

https://github.com/luke-jr/bfgminer/commit/ff7f30129f15f7a2213f8ced0cd65c9a331493d9

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

https://github.com/sgminer-dev/sgminer/commit/bac5831b355f916e0696b7bbcccfc51c057b729a

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

https://github.com/sgminer-dev/sgminer/issues/258

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.