Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2016:1098 advisory.

    jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it     to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar     applications allow you to manipulate text.

    Security Fix(es):

    * A heap-based buffer overflow flaw was found in jq's tokenadd() function. By tricking a victim into     processing a specially crafted JSON file, an attacker could use this flaw to crash jq or, potentially,     execute arbitrary code on the victim's system. (CVE-2015-8863)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201612-20 (jq: Buffer overflow)

    An off-by-one error was discovered in the tokenadd function in       jv_parse.c which triggers a heap-based buffer overflow.
  Impact :

    A remote attacker could trick a victim into processing a specially       crafted JSON file, possibly resulting in the execution of arbitrary code       with the privileges of the process.  Additionally, a remote attacker       could cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

A heap-based buffer overflow flaw was found in the tokenadd() function. By tricking a victim into processing a specially crafted JSON file, an attacker could use this flaw to crash jq or, potentially, execute arbitrary code on the victim's system.
(CVE-2015-8863)

jq was updated to fix one security issue.

This security issue was fixed :

  - CVE-2015-8863: Heap buffer overflow in tokenadd()     function (boo#976992).

ID	Name	Product	Family	Severity
234410	RHEL 7 : jq (RHSA-2016:1098)	Nessus	Red Hat Local Security Checks	critical
95636	GLSA-201612-20 : jq: Buffer overflow	Nessus	Gentoo Local Security Checks	critical
91464	Amazon Linux AMI : jq (ALAS-2016-705)	Nessus	Amazon Linux Local Security Checks	critical
90904	openSUSE Security Update : jq (openSUSE-2016-551)	Nessus	SuSE Local Security Checks	critical
90903	openSUSE Security Update : jq (openSUSE-2016-550)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2015-8863

critical

Tenable Plugins

critical

critical

critical

critical

critical