CVE-2017-16929
Current Description
The remote management interface on the Claymore Dual GPU miner 10.1 is vulnerable to an authenticated directory traversal vulnerability exploited by issuing a specially crafted request, allowing a remote attacker to read/write arbitrary files. This can be exploited via ../ sequences in the pathname to miner_file or miner_getfile.
Basic Data
| Published | December 05, 2017 |
|---|
| Last Modified | December 21, 2017 |
|---|
| Assigner | cve@mitre.org |
|---|
| Data Type | CVE |
|---|
| Data Format | MITRE |
|---|
| Data Version | 4.0 |
|---|
| Problem Type | CWE-119 |
|---|
| CVE Data Version | 4.0 |
|---|
Base Metric V2
| CVSS 2 - Version | 2.0 |
|---|
| CVSS 2 - Vector String | AV:N/AC:L/Au:S/C:C/I:C/A:N |
|---|
| CVSS 2 - Access Vector | NETWORK |
|---|
| CVSS 2 - Access Complexity | LOW |
|---|
| CVSS 2 - Authentication | SINGLE |
|---|
| CVSS 2 - Confidentiality Impact | COMPLETE |
|---|
| CVSS 2 - Availability Impact | NONE |
|---|
| CVSS 2 - Base Score | 8.5 |
|---|
| Severity | HIGH |
|---|
| Exploitability Score | 8.0 |
|---|
| Impact Score | 9.2 |
|---|
| Obtain All Privilege | false |
|---|
| Obtain User Privilege | false |
|---|
| Obtain Other Privilege | false |
|---|
Base Metric V3
| CVSS 3 - Version | 3.0 |
|---|
| CVSS 3 - Vector String | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
|---|
| CVSS 3 - Attack Vector | NETWORK |
|---|
| CVSS 3 - Attack Complexity | LOW |
|---|
| CVSS 3 - Privileges Required | LOW |
|---|
| CVSS 3 - User Interaction | NONE |
|---|
| CVSS 3 - Scope | UNCHANGED |
|---|
| CVSS 3 - Confidentiality Impact | HIGH |
|---|
| CVSS 3 - Integrity Impact | HIGH |
|---|
| CVSS 3 - Availability Impact | NONE |
|---|
| CVSS 3 - Base Score | 8.1 |
|---|
| CVSS 3 - Base Severity | HIGH |
|---|
| Exploitability Score | 2.8 |
|---|
| Base Severity | HIGH |
|---|
Configurations
-
OR - Configuration 1
| Cpe Version | Part | Vendor | Product | Version | Update | Edition | Language | SW Edition | Target SW | Target HW | Other | Version Start Including | Version End Including | Version Start Excluding | Version End Excluding |
|---|
| 2.3 | Application | Claymore Dual Miner Project | Claymore Dual Miner | 10.1 | * | * | * | * | * | * | * | | | | |
Vulnerable Software List
References
| Name | Source | URL | Tags |
|---|
| http://www.openwall.com/lists/oss-security/2017/12/04/3 | http://www.openwall.com/lists/oss-security/2017/12/04/3 | MISC | Mailing List |
| https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-16929 | https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-16929 | MISC | Third Party Advisory |
| 43231 | https://www.exploit-db.com/exploits/43231/ | EXPLOIT-DB | Exploit Third Party Advisory VDB Entry |
Follow @discotekdotca