5 - CVE-2013-6371

Executive Summary

Informations
Name	CVE-2013-6371	First vendor Publication	2014-04-22
Vendor	Cve	Last vendor Modification	2023-09-25

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score	5	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The hash functionality in json-c before 0.12 allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted JSON data, involving collisions.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6371

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-310	Cryptographic Issues

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:24612

Oval ID:	oval:org.mitre.oval:def:24612
Title:	USN-2245-1 -- json-c vulnerabilities
Description:	json-c could be made to crash or consume CPU if it processed a specially crafted JSON document.
Family:	unix	Class:	patch
Reference(s):	USN-2245-1 CVE-2013-6370 CVE-2013-6371	Version:	3
Platform(s):	Ubuntu 14.04 Ubuntu 13.10 Ubuntu 12.04	Product(s):	json-c
Definition Synopsis:
Ubuntu 14.04 release section Ubuntu 14.04 is installed AND libjson0 DPKG is earlier than 0:0.11-3ubuntu1.2 AND Ubuntu 13.10 release section Ubuntu 13.10 is installed AND libjson0 DPKG is earlier than 0:0.11-2ubuntu1.2 AND Ubuntu 12.04 release section Ubuntu 12.04 is installed AND libjson0 DPKG is earlier than 0:0.9-1ubuntu1.1

Definition Id: oval:org.mitre.oval:def:25278

Oval ID:	oval:org.mitre.oval:def:25278
Title:	RHSA-2014:0703: json-c security update (Moderate)
Description:	JSON-C implements a reference counting object model that allows you to easily construct JSON objects in C, output them as JSON-formatted strings, and parse JSON-formatted strings back into the C representation of JSON objects. Multiple buffer overflow flaws were found in the way the json-c library handled long strings in JSON documents. An attacker able to make an application using json-c parse excessively large JSON input could cause the application to crash. (CVE-2013-6370) A denial of service flaw was found in the implementation of hash arrays in json-c. An attacker could use this flaw to make an application using json-c consume an excessive amount of CPU time by providing a specially crafted JSON document that triggers multiple hash function collisions. To mitigate this issue, json-c now uses a different hash function and randomization to reduce the chance of an attacker successfully causing intentional collisions. (CVE-2013-6371) These issues were discovered by Florian Weimer of the Red Hat Product Security Team. All json-c users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
Family:	unix	Class:	patch
Reference(s):	RHSA-2014:0703-00 CVE-2013-6370 CVE-2013-6371	Version:	4
Platform(s):	Red Hat Enterprise Linux 7 CentOS Linux 7	Product(s):	json-c
Definition Synopsis:
RHEl 7 The operating system installed on the system is Red Hat Enterprise Linux 7 AND Packages section json-c-doc is earlier than 0:0.11-4.el7_0 AND json-c-devel is earlier than 0:0.11-4.el7_0 AND json-c is earlier than 0:0.11-4.el7_0 OR CentOS 7 The operating system installed on the system is CentOS Linux 7.x AND json-c is earlier than 0:0.11-4.el7_0

CPE : Common Platform Enumeration

Type	Description	Count
Application	Json-C cpe:2.3:a:json-c:json-c:0.9:::::::* cpe:2.3:a:json-c:json-c:0.8:::::::* cpe:2.3:a:json-c:json-c:0.7:::::::* cpe:2.3:a:json-c:json-c:0.6:::::::* cpe:2.3:a:json-c:json-c:0.5:::::::* cpe:2.3:a:json-c:json-c:0.4:::::::* cpe:2.3:a:json-c:json-c:0.3:::::::* cpe:2.3:a:json-c:json-c:0.2:::::::* cpe:2.3:a:json-c:json-c:0.10-20120530:::::::* cpe:2.3:a:json-c:json-c:0.1:::::::* cpe:2.3:a:json-c:json-c::::::::	11
Os	Fedoraproject Fedora cpe:2.3:o:fedoraproject:fedora:20:::::::*	1

Nessus® Vulnerability Scanner

Date	Description
2015-03-30	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2015-102.nasl - Type : ACT_GATHER_INFO
2014-10-12	Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2014-416.nasl - Type : ACT_GATHER_INFO
2014-09-09	Name : The remote database server is affected by multiple vulnerabilities. File : db2_105fp4.nasl - Type : ACT_GATHER_INFO
2014-07-30	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-0703.nasl - Type : ACT_GATHER_INFO
2014-07-24	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-0703.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-317.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2245-1.nasl - Type : ACT_GATHER_INFO
2014-04-30	Name : The remote Fedora host is missing a security update. File : fedora_2014-4975.nasl - Type : ACT_GATHER_INFO
2014-04-18	Name : The remote Fedora host is missing a security update. File : fedora_2014-5006.nasl - Type : ACT_GATHER_INFO
2014-04-18	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2014-079.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source	Url
BID	http://www.securityfocus.com/bid/66715
CONFIRM	http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html https://bugzilla.redhat.com/show_bug.cgi?id=1032311 https://github.com/json-c/json-c/commit/64e36901a0614bf64a19bc3396469c66dcd0b015
FEDORA	http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131845.html
MANDRIVA	http://www.mandriva.com/security/advisories?name=MDVSA-2014:079
SECUNIA	http://secunia.com/advisories/57791
XF	https://exchange.xforce.ibmcloud.com/vulnerabilities/92541

Alert History

If you want to see full details history, please login or register.

Date	Informations
2023-09-25 09:27:59	Multiple Updates
2023-09-19 09:28:31	Multiple Updates
2021-05-04 12:28:05	Multiple Updates
2021-04-22 01:33:51	Multiple Updates
2020-05-24 01:12:37	Multiple Updates
2020-05-23 00:38:39	Multiple Updates
2017-08-29 09:24:22	Multiple Updates
2016-11-22 09:22:59	Multiple Updates
2016-10-18 12:03:28	Multiple Updates
2016-04-26 23:45:28	Multiple Updates
2015-03-31 13:28:03	Multiple Updates
2014-10-12 13:27:05	Multiple Updates
2014-09-10 13:26:11	Multiple Updates
2014-07-31 13:24:48	Multiple Updates
2014-07-25 13:21:37	Multiple Updates
2014-06-14 13:36:29	Multiple Updates
2014-05-01 13:24:40	Multiple Updates
2014-04-22 21:22:41	First insertion

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	2
CPE ID(s)	12
Sources(s)	8
Nessus® Exploit(s)	10

	Related
5	USN-2245-1
5	RHSA-2014:0703
5	MDVSA-2015:102
5	MDVSA-2014:079
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 4 more Alert(s)

Copyright Security-Database 2006-2024 - Powered by themself ;) in 0.0529s

Facebook rss twitter linkedin mail