Softmotions IOWOW up to 1.4.15 JSON Parser buffer overflow

Summaryinfo

A vulnerability identified as critical has been detected in Softmotions IOWOW up to 1.4.15. Impacted is an unknown function of the component JSON Parser. The manipulation leads to buffer overflow. This vulnerability is uniquely identified as CVE-2022-23462. The attack is possible to be carried out remotely. No exploit exists. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Softmotions IOWOW up to 1.4.15. This issue affects some unknown functionality of the component JSON Parser. The manipulation with an unknown input leads to a buffer overflow vulnerability. Using CWE to declare the problem leads to CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. Impacted is availability. The summary by CVE is:

IOWOW is a C utility library and persistent key/value storage engine. Versions 1.4.15 and prior contain a stack buffer overflow vulnerability that allows for Denial of Service (DOS) when it parses scientific notation numbers present in JSON. A patch for this issue is available at commit a79d31e4cff1d5a08f665574b29fd885897a28fd in the `master` branch of the repository. There are no workarounds other than applying the patch.

The weakness was disclosed 10/22/2022 as GHSL-2022-066. The advisory is shared at securitylab.github.com. The identification of this vulnerability is CVE-2022-23462 since 01/19/2022. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available.

Applying the patch a79d31e4cff1d5a08f665574b29fd885897a28fd is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2022-28532). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Softmotions

Name

• IOWOW

Version

• 1.4.0
• 1.4.1
• 1.4.2
• 1.4.3
• 1.4.4
• 1.4.5
• 1.4.6
• 1.4.7
• 1.4.8
• 1.4.9
• 1.4.10
• 1.4.11
• 1.4.12
• 1.4.13
• 1.4.14
• 1.4.15

License

• open-source

Website

• Product: https://github.com/Softmotions/iowow/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion