FKIE_CVE-2014-4502

Vulnerability from fkie_nvd - Published: 2014-07-23 14:55 - Updated: 2026-06-17 00:10
Severity
Summary
Multiple heap-based buffer overflows in the parse_notify function in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 4.1.0 allow remote pool servers to have unspecified impact via a (1) large or (2) negative value in the Extranonc2_size parameter in a mining.subscribe response and a crafted mining.notify request.
References
cve@mitre.orghttp://seclists.org/fulldisclosure/2014/Jul/119
cve@mitre.orghttp://www.securityfocus.com/bid/68831
cve@mitre.orghttps://github.com/ckolivas/cgminer/commit/e1c5050734123973b99d181c45e74b2cbb00272eExploit, Patch
cve@mitre.orghttps://github.com/luke-jr/bfgminer/commit/ff7f30129f15f7a2213f8ced0cd65c9a331493d9Exploit, Patch
cve@mitre.orghttps://github.com/sgminer-dev/sgminer/commit/bac5831b355f916e0696b7bbcccfc51c057b729aExploit, Patch
cve@mitre.orghttps://github.com/sgminer-dev/sgminer/issues/258
af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2014/Jul/119
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/68831
af854a3a-2127-422b-91ae-364da2661108https://github.com/ckolivas/cgminer/commit/e1c5050734123973b99d181c45e74b2cbb00272eExploit, Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/luke-jr/bfgminer/commit/ff7f30129f15f7a2213f8ced0cd65c9a331493d9Exploit, Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/sgminer-dev/sgminer/commit/bac5831b355f916e0696b7bbcccfc51c057b729aExploit, Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/sgminer-dev/sgminer/issues/258
Impacted products
Vendor Product Version
bfgminer bfgminer *
sgminer_project sgminer *
sgminer_project sgminer 4.0.0
sgminer_project sgminer 4.1.0
sgminer_project sgminer 4.1.153
sgminer_project sgminer 4.1.242
sgminer_project sgminer 4.1.271
sgminer_project sgminer 4.2.0
bfgminer bfgminer *
bfgminer bfgminer 3.2.0
bfgminer bfgminer 3.2.1
bfgminer bfgminer 3.2.2
bfgminer bfgminer 3.2.3
bfgminer bfgminer 3.2.4
bfgminer bfgminer 3.2.5
bfgminer bfgminer 3.2.6
bfgminer bfgminer 3.2.7
bfgminer bfgminer 3.2.8
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:bfgminer:bfgminer:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8FB3B702-DBE8-442F-ADEE-451E75320DDC",
              "versionEndIncluding": "4.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sgminer_project:sgminer:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "674C554E-841D-4D4B-99B9-F2641327AF5A",
              "versionEndIncluding": "4.2.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sgminer_project:sgminer:4.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "0E3DD6BA-85F4-49B4-B489-DCB763AA65E2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sgminer_project:sgminer:4.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "95929A1F-64B1-45E7-A9A0-E1603FDCD176",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sgminer_project:sgminer:4.1.153:*:*:*:*:*:*:*",
              "matchCriteriaId": "22ADC6DB-0EB9-43E8-AA12-09FD74CC4914",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sgminer_project:sgminer:4.1.242:*:*:*:*:*:*:*",
              "matchCriteriaId": "FB19CC92-1BC6-44F2-B11B-B87EFC0AF8CF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sgminer_project:sgminer:4.1.271:*:*:*:*:*:*:*",
              "matchCriteriaId": "94A63F06-378D-46BB-98D2-03E70E94A83C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sgminer_project:sgminer:4.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "593E9A8D-2A7D-4089-8E4B-A26FF4E28407",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:bfgminer:bfgminer:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6EE2FAD5-17A9-4289-A55B-029E9C1FD24E",
              "versionEndIncluding": "3.2.9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bfgminer:bfgminer:3.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "1D5FBC7F-A42D-4B77-A5F9-40A5C01F881B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bfgminer:bfgminer:3.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "1180D535-1EC2-4C8E-891E-B5DFAB4CCC6D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bfgminer:bfgminer:3.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "D105E68A-9261-4B9D-A662-FA3CEB379D89",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bfgminer:bfgminer:3.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "B83E2C83-D877-494A-BE6F-D2D6BFBD04AE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bfgminer:bfgminer:3.2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "1889D60B-2777-4F14-B4BD-4C068CE3EAC1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bfgminer:bfgminer:3.2.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "74DA5D3E-E725-435C-ADF0-B9B3141DB691",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bfgminer:bfgminer:3.2.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "728F3472-BE81-4D3F-BA1D-17453F1A1BC5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bfgminer:bfgminer:3.2.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "708E901D-5DFB-4403-8928-C780AD7780C9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:bfgminer:bfgminer:3.2.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "EA31DFFC-71FE-438E-BC02-5A880F1AE568",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple heap-based buffer overflows in the parse_notify function in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 4.1.0 allow remote pool servers to have unspecified impact via a (1) large or (2) negative value in the Extranonc2_size parameter in a mining.subscribe response and a crafted mining.notify request."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples desbordamientos de buffer basado en memoria din\u00e1mica en la funci\u00f3n parse_notify en sgminer anterior a 4.2.2, cgminer anterior a 4.3.5 y BFGMiner anterior a 4.1.0 permiten a servidores remotos de pool tener impacto no especificado a trav\u00e9s de un valor (1) grande o (2) negativo en el par\u00e1metro Extranonc2_size en una respuesta mining.subscribe y una respuesta mining.notify manipulada."
    }
  ],
  "id": "CVE-2014-4502",
  "lastModified": "2026-06-17T00:10:08.430",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2014-07-23T14:55:06.117",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://seclists.org/fulldisclosure/2014/Jul/119"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/68831"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "https://github.com/ckolivas/cgminer/commit/e1c5050734123973b99d181c45e74b2cbb00272e"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "https://github.com/luke-jr/bfgminer/commit/ff7f30129f15f7a2213f8ced0cd65c9a331493d9"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "https://github.com/sgminer-dev/sgminer/commit/bac5831b355f916e0696b7bbcccfc51c057b729a"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://github.com/sgminer-dev/sgminer/issues/258"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://seclists.org/fulldisclosure/2014/Jul/119"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/68831"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "https://github.com/ckolivas/cgminer/commit/e1c5050734123973b99d181c45e74b2cbb00272e"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "https://github.com/luke-jr/bfgminer/commit/ff7f30129f15f7a2213f8ced0cd65c9a331493d9"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "url": "https://github.com/sgminer-dev/sgminer/commit/bac5831b355f916e0696b7bbcccfc51c057b729a"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/sgminer-dev/sgminer/issues/258"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.