Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

sgminer, cgminer and BFGMiner can be crashed by long URLs

CVE-2014-4501 · published 12 years ago
Summary

Older versions of sgminer (before 4.2.2), cgminer (before 4.3.5) and BFGMiner (before 3.3.0) may stop working when a mining pool sends a very long URL in a reconnect message. This can cause the software to freeze or shut down, interrupting mining operations. Upgrade to the latest releases of each program to protect against this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
sgminer_project sgminer <= 4.2.1
4.0.0
4.1.0
4.1.153
4.1.242
4.1.271
4.2.0
cpe:2.3:a:sgminer_project:sgminer:*:*:*:*:*:*:*:*
cgminer_project cgminer <= 4.3.4
4.3.0
4.3.1
4.3.2
4.3.3
cpe:2.3:a:cgminer_project:cgminer:*:*:*:*:*:*:*:*
bfgminer bfgminer <= 3.2.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.8
cpe:2.3:a:bfgminer:bfgminer:*:*:*:*:*:*:*:*
Original advisory text
Multiple stack-based buffer overflows in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 3.3.0 allow remote pool servers to have unspecified impact via a long URL in a client.reconn...
Multiple stack-based buffer overflows in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 3.3.0 allow remote pool servers to have unspecified impact via a long URL in a client.reconnect stratum message to the (1) extract_sockaddr or (2) parse_reconnect functions in util.c.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
3% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published23 Jul 2014
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2014-4501 · NVD
Track software like this
Free during beta