Hexagon HXG Ethereum ERC20 Token transfer _to/_value integer overflow

Summaryinfo

A vulnerability, which was classified as critical, has been found in Hexagon HXG. Affected is the function transfer of the component Ethereum ERC20 Token Handler. The manipulation of the argument _to/_value as part of Smart Contract leads to integer overflow. This vulnerability is uniquely identified as CVE-2018-11239. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Hexagon HXG (affected version unknown). It has been rated as critical. This issue affects the function transfer of the component Ethereum ERC20 Token Handler. The manipulation of the argument _to/_value as part of a Smart Contract leads to a integer overflow vulnerability. Using CWE to declare the problem leads to CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An integer overflow in the _transfer function of a smart contract implementation for Hexagon (HXG), an Ethereum ERC20 token, allows attackers to accomplish an unauthorized increase of digital assets by providing a _to argument in conjunction with a large _value argument, as exploited in the wild in May 2018, aka the "burnOverflow" issue.

The bug was discovered 05/18/2018. The weakness was disclosed 05/19/2018 (Website). It is possible to read the advisory at peckshield.com. The identification of this vulnerability is CVE-2018-11239 since 05/18/2018. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Hexagon HXG

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion