The default configuration of ASP.NET in Mono before 2.6.4 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by the __VIEWSTATE parameter to 2.0/menu/menu1.aspx in the XSP sample project.

It was discovered that the Mono System.Web library incorrectly filtered certain error messages related to forbidden files. If a user were tricked into opening a specially crafted URL, an attacker could possibly exploit this to conduct cross-site scripting (XSS) attacks.
(CVE-2012-3382)

It was discovered that the Mono System.Web library incorrectly handled the EnableViewStateMac property. If a user were tricked into opening a specially crafted URL, an attacker could possibly exploit this to conduct cross-site scripting (XSS) attacks. This issue only affected Ubuntu 10.04 LTS. (CVE-2010-4159).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mono's ASP.NET implementation did not set the 'EnableViewStateMac' property by default. Attackers could exploit that to conduct cross-site scripting (XSS) attacks.

- Thu Jun 24 2010 Christian Krause <chkr at     fedoraproject.org> - 2.4.3.1-2

    - Add upstream patch for CVE-2010-1459:
      http://anonsvn.mono-project.com/viewvc?view=revision&r       evision=156450

  - Wed Jan 13 2010 Christian Krause <chkr at     fedoraproject.org> - 2.4.3.1-1

    - Update to 2.4.3.1

    - Wed Dec 23 2009 Christian Krause <chkr at       fedoraproject.org> - 2.4.3-1

    - Update to 2.4.3

    - Drop mono-242-metadata-appconf.patch (fixed upstream)

    - package mono.snk for packages without bundled keys to       use

    - put mono.snk in /etc/pki/mono/

    - package /etc/pki/mono/* in mono-devel

    - change %gac_dll macro to be more specific about the       files to package (necessary to correctly select all       files for the moonlight subpackage without any       dangling symlinks)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- update the mono stack to release 2.6.4

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mono's ASP.NET implementation did not set the 'EnableViewStateMac' property by default. Attackers could exploit that to conduct cross-site-scripting (XSS) attacks.

ID	Name	Product	Family	Severity
60126	Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : mono vulnerabilities (USN-1517-1)	Nessus	Ubuntu Local Security Checks	medium
50892	SuSE 11 / 11.1 Security Update : mono-core / Mono (SAT Patch Numbers 2326 / 2474)	Nessus	SuSE Local Security Checks	medium
47720	Fedora 12 : mono-2.4.3.1-2.fc12 (2010-10433)	Nessus	Fedora Local Security Checks	medium
47719	Fedora 13 : gnome-sharp-2.24.1-1.fc13 / gtksourceview-sharp-2.0.12-11.fc13 / libgdiplus-2.6.4-1.fc13 / etc (2010-10332)	Nessus	Fedora Local Security Checks	medium
47573	openSUSE Security Update : bytefx-data-mysql (openSUSE-SU-2010:0342-1)	Nessus	SuSE Local Security Checks	medium
47571	openSUSE Security Update : bytefx-data-mysql (openSUSE-SU-2010:0342-1)	Nessus	SuSE Local Security Checks	medium
47569	openSUSE Security Update : bytefx-data-mysql (openSUSE-SU-2010:0342-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2010-1459

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium