Bug 517948 – <net-misc/cgminer-4.2.3: denial of service (CVE-2014-4503)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2014-07-24 10:11:08 UTC]

CVE-2014-4503 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4503):
  The parse_notify function in util.c in sgminer before 4.2.2 and cgminer 
  3.3.0 through 4.0.1 allows man-in-the-middle attackers to cause a denial 
  of service (application exit) via a crafted (1) bbversion, (2) prev_hash, 
  (3) nbit, or (4) ntime parameter in a mining.notify action stratum message.


@maintainer(s): since the fixed version is already in the tree, please remove the affected versions.

[Comment 1 Yury German 2014-07-26 01:30:39 UTC]

Maintainer(s), please drop the vulnerable version(s).

[Comment 2 GLSAMaker/CVETool Bot 2014-08-01 03:29:18 UTC]

CVE-2014-4503 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-4503):
  The parse_notify function in util.c in sgminer before 4.2.2 and cgminer
  3.3.0 through 4.0.1 allows man-in-the-middle attackers to cause a denial of
  service (application exit) via a crafted (1) bbversion, (2) prev_hash, (3)
  nbit, or (4) ntime parameter in a mining.notify action stratum message.

[Comment 3 Anthony Basile 2014-08-01 12:54:57 UTC]

The older versions are off the tree.

[Comment 4 Mikle Kolyada (RETIRED) 2014-08-01 12:55:45 UTC]

(In reply to Anthony Basile from comment #3)
> The older versions are off the tree.

Thanks!