Multiple cross-site scripting (XSS) vulnerabilities in the ASP.net class libraries in Mono 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted attributes related to (1) HtmlControl.cs (PreProcessRelativeReference), (2) HtmlForm.cs (RenderAttributes), (3) HtmlInputButton (RenderAttributes), (4) HtmlInputRadioButton (RenderAttributes), and (5) HtmlSelect (RenderChildren).

Multiple vulnerabilities has been found and corrected in mono :

IOActive Inc. found a buffer overflow in Mono.Math.BigInteger class in Mono 1.2.5.1 and previous versions, which allows arbitrary code execution by context-dependent attackers (CVE-2007-5197).

Multiple cross-site scripting (XSS) vulnerabilities in the ASP.net class libraries in Mono 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted attributes related to (1) HtmlControl.cs (PreProcessRelativeReference), (2) HtmlForm.cs (RenderAttributes), (3) HtmlInputButton (RenderAttributes), (4) HtmlInputRadioButton (RenderAttributes), and (5) HtmlSelect (RenderChildren) (CVE-2008-3422).

CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the query string (CVE-2008-3906).

The XML HMAC signature system did not correctly check certain lengths.
If an attacker sent a truncated HMAC, it could bypass authentication, leading to potential privilege escalation (CVE-2009-0217).

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

The updated packages have been patched to fix these issues.

Multiple vulnerabilities has been found and corrected in mono :

Multiple cross-site scripting (XSS) vulnerabilities in the ASP.net class libraries in Mono 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted attributes related to (1) HtmlControl.cs (PreProcessRelativeReference), (2) HtmlForm.cs (RenderAttributes), (3) HtmlInputButton (RenderAttributes), (4) HtmlInputRadioButton (RenderAttributes), and (5) HtmlSelect (RenderChildren) (CVE-2008-3422).

The XML HMAC signature system did not correctly check certain lengths.
If an attacker sent a truncated HMAC, it could bypass authentication, leading to potential privilege escalation (CVE-2009-0217).

This update fixes these vulnerabilities.

It was discovered that the XML HMAC signature system did not correctly check certain lengths. If an attacker sent a truncated HMAC, it could bypass authentication, leading to potential privilege escalation.
(CVE-2009-0217)

It was discovered that Mono did not properly escape certain attributes in the ASP.net class libraries which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output.
With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data (such as passwords), within the same domain. This issue only affected Ubuntu 8.04 LTS. (CVE-2008-3422)

It was discovered that Mono did not properly filter CRLF injections in the query string. If a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, steal confidential data (such as passwords), or perform cross-site request forgeries. This issue only affected Ubuntu 8.04 LTS. (CVE-2008-3906).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This patch fixes two security problems and one critical bug :

Makes sure that values of all the tags which can be exploited are encoded to make sure no exploit is possible. (CVE-2008-3422)

A header injection problem in Sys.Web was fixed.

The remote host is running Mono, an open source, UNIX implementation of the Microsoft .NET development platform. 

The version of Mono installed on the remote host fails to encode user-supplied input to the URL before using it for the default 'action' of a form.  An attacker may be able to leverage this to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected site.

This patch fixes two security problems and one critical bug :

Makes sure that values of all the tags which can be exploited are encoded to make sure no exploit is possible. (CVE-2008-3422)

A header injection problem in Sys.Web was fixed.

Fix a problem with the Novell.Directory.Ldap.dll as exposed by iFolder3. (Novell Bugzilla 383357)

ID	Name	Product	Family	Severity
43041	Mandriva Linux Security Advisory : mono (MDVSA-2009:322)	Nessus	Mandriva Local Security Checks	high
42095	Mandriva Linux Security Advisory : mono (MDVSA-2009:268)	Nessus	Mandriva Local Security Checks	medium
40794	Ubuntu 8.04 LTS / 8.10 / 9.04 : mono vulnerabilities (USN-826-1)	Nessus	Ubuntu Local Security Checks	medium
39925	openSUSE Security Update : bytefx-data-mysql (bytefx-data-mysql-173)	Nessus	SuSE Local Security Checks	medium
35556	Mono ASP.NET action Attribute XSS	Nessus	CGI abuses : XSS	medium
34071	SuSE 10 Security Update : Mono (ZYPP Patch Number 5560)	Nessus	SuSE Local Security Checks	medium
34070	openSUSE 10 Security Update : bytefx-data-mysql (bytefx-data-mysql-5558)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2008-3422

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium