Python-cjson Unicode Character Encoding Buffer Overflow Vulnerability

Bugtraq ID:	41279
Class:	Boundary Condition Error
CVE:	CVE-2010-1666
Remote:	Yes
Local:	No
Published:	May 25 2010 12:00AM
Updated:	Apr 13 2015 09:43PM
Credit:	Matt Giuca
Vulnerable:	Python-cjson python-cjson 1.0.5 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0
Not Vulnerable:

Python-cjson Unicode Character Encoding Buffer Overflow Vulnerability

Python-cjson is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

An attacker can exploit this issue to execute arbitrary code in the context of the application that uses the affected module. Failed exploit attempts will likely result in denial-of-service conditions.

Python-cjson version 1.0.5 on UCS4 builds is vulnerable; other versions may also be affected.

Python-cjson Unicode Character Encoding Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Python-cjson Unicode Character Encoding Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references for more information.


Debian Linux 5.0 alpha

• Debian python-cjson-dbg_1.0.5-1+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/p/python-cjson/python-cjs on-dbg_1.0.5-1+lenny1_alpha.deb


• Debian python-cjson_1.0.5-1+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/p/python-cjson/python-cjs on_1.0.5-1+lenny1_alpha.deb

Debian Linux 5.0 amd64

• Debian python-cjson-dbg_1.0.5-1+lenny1_amd64.deb
  http://security.debian.org/pool/updates/main/p/python-cjson/python-cjs on-dbg_1.0.5-1+lenny1_amd64.deb


• Debian python-cjson_1.0.5-1+lenny1_amd64.deb
  http://security.debian.org/pool/updates/main/p/python-cjson/python-cjs on_1.0.5-1+lenny1_amd64.deb

Debian Linux 5.0 ia-32

• Debian python-cjson-dbg_1.0.5-1+lenny1_i386.deb
  http://security.debian.org/pool/updates/main/p/python-cjson/python-cjs on-dbg_1.0.5-1+lenny1_i386.deb


• Debian python-cjson_1.0.5-1+lenny1_i386.deb
  http://security.debian.org/pool/updates/main/p/python-cjson/python-cjs on_1.0.5-1+lenny1_i386.deb

Debian Linux 5.0 hppa

• Debian python-cjson-dbg_1.0.5-1+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/p/python-cjson/python-cjs on-dbg_1.0.5-1+lenny1_hppa.deb


• Debian python-cjson_1.0.5-1+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/p/python-cjson/python-cjs on_1.0.5-1+lenny1_hppa.deb

Debian Linux 5.0 mips

• Debian python-cjson-dbg_1.0.5-1+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/p/python-cjson/python-cjs on-dbg_1.0.5-1+lenny1_mips.deb


• Debian python-cjson_1.0.5-1+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/p/python-cjson/python-cjs on_1.0.5-1+lenny1_mips.deb

Debian Linux 5.0 ia-64

• Debian python-cjson-dbg_1.0.5-1+lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/p/python-cjson/python-cjs on-dbg_1.0.5-1+lenny1_ia64.deb


• Debian python-cjson_1.0.5-1+lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/p/python-cjson/python-cjs on_1.0.5-1+lenny1_ia64.deb

Debian Linux 5.0 s/390

• Debian python-cjson-dbg_1.0.5-1+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/p/python-cjson/python-cjs on-dbg_1.0.5-1+lenny1_s390.deb


• Debian python-cjson_1.0.5-1+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/p/python-cjson/python-cjs on_1.0.5-1+lenny1_s390.deb

Debian Linux 5.0 arm

• Debian python-cjson-dbg_1.0.5-1+lenny1_arm.deb
  http://security.debian.org/pool/updates/main/p/python-cjson/python-cjs on-dbg_1.0.5-1+lenny1_arm.deb


• Debian python-cjson_1.0.5-1+lenny1_arm.deb
  http://security.debian.org/pool/updates/main/p/python-cjson/python-cjs on_1.0.5-1+lenny1_arm.deb

Debian Linux 5.0 mipsel

• Debian python-cjson-dbg_1.0.5-1+lenny1_mipsel.deb
  http://security.debian.org/pool/updates/main/p/python-cjson/python-cjs on-dbg_1.0.5-1+lenny1_mipsel.deb


• Debian python-cjson_1.0.5-1+lenny1_mipsel.deb
  http://security.debian.org/pool/updates/main/p/python-cjson/python-cjs on_1.0.5-1+lenny1_mipsel.deb

Debian Linux 5.0 powerpc

• Debian python-cjson-dbg_1.0.5-1+lenny1_powerpc.deb
  http://security.debian.org/pool/updates/main/p/python-cjson/python-cjs on-dbg_1.0.5-1+lenny1_powerpc.deb


• Debian python-cjson_1.0.5-1+lenny1_powerpc.deb
  http://security.debian.org/pool/updates/main/p/python-cjson/python-cjs on_1.0.5-1+lenny1_powerpc.deb

Debian Linux 5.0 armel

• Debian python-cjson-dbg_1.0.5-1+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/p/python-cjson/python-cjs on-dbg_1.0.5-1+lenny1_armel.deb


• Debian python-cjson_1.0.5-1+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/p/python-cjson/python-cjs on_1.0.5-1+lenny1_armel.deb

Debian Linux 5.0 sparc

• Debian python-cjson-dbg_1.0.5-1+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/p/python-cjson/python-cjs on-dbg_1.0.5-1+lenny1_sparc.deb


• Debian python-cjson_1.0.5-1+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/p/python-cjson/python-cjs on_1.0.5-1+lenny1_sparc.deb

Python-cjson Unicode Character Encoding Buffer Overflow Vulnerability

References:

• Python-cjson Homepage (Python-cjson)
  
• Ubuntu Bug Report Page (Ubuntu)