Buffer overflow in the printbuf APIs in json-c before 0.12 allows remote attackers to cause a denial of service via unspecified vectors.

Updated json-c packages fix security vulnerabilities :

Florian Weimer reported that the printbuf APIs used in the json-c library used ints for counting buffer lengths, which is inappropriate for 32bit architectures. These functions need to be changed to using size_t if possible for sizes, or to be hardened against negative values if not. This could be used to cause a denial of service in an application linked to the json-c library (CVE-2013-6370).

Florian Weimer reported that the hash function in the json-c library was weak, and that parsing smallish JSON strings showed quadratic timing behaviour. This could cause an application linked to the json-c library, and that processes some specially crafted JSON data, to use excessive amounts of CPU (CVE-2013-6371).

The hash functionality in json-c before 0.12 allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted JSON data, involving collisions.

Buffer overflow in the printbuf APIs in json-c before 0.12 allows remote attackers to cause a denial of service via unspecified vectors.

Updated json-c packages that fix two security issues are now available for Red Hat Enterprise Linux 7.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

JSON-C implements a reference counting object model that allows you to easily construct JSON objects in C, output them as JSON-formatted strings, and parse JSON-formatted strings back into the C representation of JSON objects.

Multiple buffer overflow flaws were found in the way the json-c library handled long strings in JSON documents. An attacker able to make an application using json-c parse excessively large JSON input could cause the application to crash. (CVE-2013-6370)

A denial of service flaw was found in the implementation of hash arrays in json-c. An attacker could use this flaw to make an application using json-c consume an excessive amount of CPU time by providing a specially crafted JSON document that triggers multiple hash function collisions. To mitigate this issue, json-c now uses a different hash function and randomization to reduce the chance of an attacker successfully causing intentional collisions. (CVE-2013-6371)

These issues were discovered by Florian Weimer of the Red Hat Product Security Team.

All json-c users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0703 advisory.

    - fix has collision CVE-2013-6371
    - fix buffer overflow CVE-2013-6370

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This json-c update fixes the following two security issue :

  - bnc#870147: Fixed buffer overflow if size_t is larger     than int (CVE-2013-6370).

  - bnc#870147: Fixed possible hash collision DoS     (CVE-2013-6371).

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2245-1 advisory.

    Florian Weimer discovered that json-c incorrectly handled buffer lengths. An attacker could use this issue     with a specially-crafted large JSON document to cause json-c to crash, resulting in a denial of service.
    (CVE-2013-6370)

    Florian Weimer discovered that json-c incorrectly handled hash arrays. An attacker could use this issue     with a specially-crafted JSON document to cause json-c to consume CPU resources, resulting in a denial of     service. (CVE-2013-6371)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Address CVE-2013-6370 and CVE-2013-6371.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
82355	Mandriva Linux Security Advisory : json-c (MDVSA-2015:102)	Nessus	Mandriva Local Security Checks	medium
78359	Amazon Linux AMI : json-c (ALAS-2014-416)	Nessus	Amazon Linux Local Security Checks	medium
76898	RHEL 7 : json-c (RHSA-2014:0703)	Nessus	Red Hat Local Security Checks	medium
76736	Oracle Linux 7 : json-c (ELSA-2014-0703)	Nessus	Oracle Linux Local Security Checks	high
75330	openSUSE Security Update : json-c (openSUSE-SU-2014:0558-1)	Nessus	SuSE Local Security Checks	medium
74509	Ubuntu 14.04 LTS : json-c vulnerabilities (USN-2245-1)	Nessus	Ubuntu Local Security Checks	high
73772	Fedora 19 : json-c-0.11-6.fc19 (2014-4975)	Nessus	Fedora Local Security Checks	medium
73604	Mandriva Linux Security Advisory : json-c (MDVSA-2014:079)	Nessus	Mandriva Local Security Checks	medium
73603	Fedora 20 : json-c-0.11-6.fc20 (2014-5006)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-6370

high

Tenable Plugins

medium

medium

medium

high

medium

high

medium

medium

medium