The hash functionality in json-c before 0.12 allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted JSON data, involving collisions.

Updated json-c packages fix security vulnerabilities :

Florian Weimer reported that the printbuf APIs used in the json-c library used ints for counting buffer lengths, which is inappropriate for 32bit architectures. These functions need to be changed to using size_t if possible for sizes, or to be hardened against negative values if not. This could be used to cause a denial of service in an application linked to the json-c library (CVE-2013-6370).

Florian Weimer reported that the hash function in the json-c library was weak, and that parsing smallish JSON strings showed quadratic timing behaviour. This could cause an application linked to the json-c library, and that processes some specially crafted JSON data, to use excessive amounts of CPU (CVE-2013-6371).

The hash functionality in json-c before 0.12 allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted JSON data, involving collisions.

Buffer overflow in the printbuf APIs in json-c before 0.12 allows remote attackers to cause a denial of service via unspecified vectors.

According to its version, the installation of IBM DB2 10.5 running on the remote host is affected by the following vulnerabilities :

  - An error exists related to JavaScript Object Notation     (JSON-C) handling, string parsing, and the hash function     that allows denial of service attacks. (CVE-2013-6371)

  - A buffer overflow error exists related to handling     'ALTER MODULE' statements that could lead to server     crashes or arbitrary code execution. (CVE-2014-3094)

  - An error exists related to handling 'SELECT' statements     having subqueries using 'UNION' that allows denial     of service attacks. (CVE-2014-3095)

  - An error exists related to Columnar Data Engine (CDE)     tables and 'LOAD' statement handling that allows local     information disclosure. (CVE-2014-4805)

Updated json-c packages that fix two security issues are now available for Red Hat Enterprise Linux 7.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

JSON-C implements a reference counting object model that allows you to easily construct JSON objects in C, output them as JSON-formatted strings, and parse JSON-formatted strings back into the C representation of JSON objects.

Multiple buffer overflow flaws were found in the way the json-c library handled long strings in JSON documents. An attacker able to make an application using json-c parse excessively large JSON input could cause the application to crash. (CVE-2013-6370)

A denial of service flaw was found in the implementation of hash arrays in json-c. An attacker could use this flaw to make an application using json-c consume an excessive amount of CPU time by providing a specially crafted JSON document that triggers multiple hash function collisions. To mitigate this issue, json-c now uses a different hash function and randomization to reduce the chance of an attacker successfully causing intentional collisions. (CVE-2013-6371)

These issues were discovered by Florian Weimer of the Red Hat Product Security Team.

All json-c users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

From Red Hat Security Advisory 2014:0703 :

Updated json-c packages that fix two security issues are now available for Red Hat Enterprise Linux 7.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

JSON-C implements a reference counting object model that allows you to easily construct JSON objects in C, output them as JSON-formatted strings, and parse JSON-formatted strings back into the C representation of JSON objects.

Multiple buffer overflow flaws were found in the way the json-c library handled long strings in JSON documents. An attacker able to make an application using json-c parse excessively large JSON input could cause the application to crash. (CVE-2013-6370)

A denial of service flaw was found in the implementation of hash arrays in json-c. An attacker could use this flaw to make an application using json-c consume an excessive amount of CPU time by providing a specially crafted JSON document that triggers multiple hash function collisions. To mitigate this issue, json-c now uses a different hash function and randomization to reduce the chance of an attacker successfully causing intentional collisions. (CVE-2013-6371)

These issues were discovered by Florian Weimer of the Red Hat Product Security Team.

All json-c users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

This json-c update fixes the following two security issue :

  - bnc#870147: Fixed buffer overflow if size_t is larger     than int (CVE-2013-6370).

  - bnc#870147: Fixed possible hash collision DoS     (CVE-2013-6371).

Florian Weimer discovered that json-c incorrectly handled buffer lengths. An attacker could use this issue with a specially crafted large JSON document to cause json-c to crash, resulting in a denial of service. (CVE-2013-6370)

Florian Weimer discovered that json-c incorrectly handled hash arrays.
An attacker could use this issue with a specially crafted JSON document to cause json-c to consume CPU resources, resulting in a denial of service. (CVE-2013-6371).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Address CVE-2013-6370 and CVE-2013-6371.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
82355	Mandriva Linux Security Advisory : json-c (MDVSA-2015:102)	Nessus	Mandriva Local Security Checks	medium
78359	Amazon Linux AMI : json-c (ALAS-2014-416)	Nessus	Amazon Linux Local Security Checks	medium
77571	IBM DB2 10.5 < Fix Pack 4 Multiple Vulnerabilities	Nessus	Databases	high
76898	RHEL 7 : json-c (RHSA-2014:0703)	Nessus	Red Hat Local Security Checks	medium
76736	Oracle Linux 7 : json-c (ELSA-2014-0703)	Nessus	Oracle Linux Local Security Checks	medium
75330	openSUSE Security Update : json-c (openSUSE-SU-2014:0558-1)	Nessus	SuSE Local Security Checks	medium
74509	Ubuntu 14.04 LTS : json-c vulnerabilities (USN-2245-1)	Nessus	Ubuntu Local Security Checks	high
73772	Fedora 19 : json-c-0.11-6.fc19 (2014-4975)	Nessus	Fedora Local Security Checks	medium
73604	Mandriva Linux Security Advisory : json-c (MDVSA-2014:079)	Nessus	Mandriva Local Security Checks	medium
73603	Fedora 20 : json-c-0.11-6.fc20 (2014-5006)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-6371

high

Tenable Plugins

medium

medium

high

medium

medium

medium

high

medium

medium

medium