Twenty Year Anniversary

Claymore Dual GPU Miner 10.5 Format String

Claymore Dual GPU Miner 10.5 Format String
Posted Feb 3, 2018
Authored by res1n

Claymore Dual GPU Miner versions 10.5 and below suffer from format string vulnerabilities.

tags | exploit, vulnerability
advisories | CVE-2018-6317
MD5 | fdbaa03bf96433f880d5f0591306d178

Claymore Dual GPU Miner 10.5 Format String

Change Mirror Download

Claymore Dual Gpu Miner <= 10.5 Format Strings Vulnerability
=======================================================================

product: Claymore's Dual Miner
vulnerable version: <= 10.5
fixed version: 10.6
CVE number: - CVE-2018a6317
impact: critical
homepage: https://bitcointalk.org/index.php?topic=1433925.0
found: 2018-01-26
by: twitter.com/res1n

=======================================================================


Vulnerability overview/description:
-----------------------------------
Claymoreas Dual GPU Miner 10.5 and below is vulnerable to a format
strings vulnerability. This allows an unauthenticated remote attacker to
read memory addresses, or immediately terminate the mining process
causing a denial of service.

1) By sending a custom request to the json api on port 3333 of the
remote management service it's possible to leak stack addresses and
possibly rewrite stack addresses with %p. I wasn't able to break out of
the json padding but someone else may be able to as %s also dumps string
contents.

example - echo -e '{"id":1,"jsonrpc":"1.0","method":"%x %x %x %x"}' | nc
192.168.1.139 3333 & printf "\n".

2) Sending %n to the json api on port 3333 immediately kills the mining
process.

example - echo -e '{"id":1,"jsonrpc":"1.0","method":"%n"}' | nc
192.168.1.139 3333 & printf "\n".

Solution
------------------------
Upgrade to version 10.6


Vendor contact timeline:
------------------------
01/26/18aaaReported to dev
01/26/18 a Confirmed and immediately patched. 10.6 released request for
3a4 day embargo
01/31/18aaaPublic Disclosure

Writeup -
https://medium.com/secjuice/claymore-dual-gpu-miner-10-5-format-strings-vulnerability-916ab3d2db30


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

August 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    19 Files
  • 2
    Aug 2nd
    17 Files
  • 3
    Aug 3rd
    16 Files
  • 4
    Aug 4th
    1 Files
  • 5
    Aug 5th
    1 Files
  • 6
    Aug 6th
    19 Files
  • 7
    Aug 7th
    15 Files
  • 8
    Aug 8th
    9 Files
  • 9
    Aug 9th
    7 Files
  • 10
    Aug 10th
    10 Files
  • 11
    Aug 11th
    1 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    14 Files
  • 14
    Aug 14th
    18 Files
  • 15
    Aug 15th
    38 Files
  • 16
    Aug 16th
    16 Files
  • 17
    Aug 17th
    22 Files
  • 18
    Aug 18th
    3 Files
  • 19
    Aug 19th
    3 Files
  • 20
    Aug 20th
    21 Files
  • 21
    Aug 21st
    7 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close