Mono, when Moonlight before 2.3.0.1 or 2.99.x before 2.99.0.10 is used, does not properly validate arguments to generic methods, which allows remote attackers to bypass generic constraints, and possibly execute arbitrary code, via a crafted method call.

Untrusted Moonlight apps could bypass constraints on methods which potentially allowed attackers to execute arbitrary code (CVE-2010-4254).

The remote host is affected by the vulnerability described in GLSA-201206-13 (Mono: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mono and Mono debugger.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could execute arbitrary code, bypass general       constraints, obtain the source code for .aspx applications, obtain other       sensitive information, cause a Denial of Service, modify internal data       structures, or corrupt the internal state of the security manager.
    A local attacker could entice a user into running Mono debugger in a       directory containing a specially crafted library file to execute       arbitrary code with the privileges of the user running Mono debugger.
    A context-dependent attacker could bypass the authentication mechanism       provided by the XML Signature specification.
  Workaround :

    There is no known workaround at this time.

- CVE-2010-4159

    - CVE-2010-4254

    - mono-core and mono-addins do not depend on mono-devel       anymore

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of moonlight does not allow abuse of mutable Strings to execute arbitrary code anymore. (CVE-2010-4254)

Untrusted Moonlight apps could bypass constraints on methods which potentially allowed attackers to execute arbitrary code.
(CVE-2010-4254)

ID	Name	Product	Family	Severity
75587	openSUSE Security Update : libmoon-devel (openSUSE-SU-2010:1062-1)	Nessus	SuSE Local Security Checks	high
59651	GLSA-201206-13 : Mono: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
53241	Fedora 14 : mono-2.6.7-4.fc14 / mono-addins-0.5-2.fc14 (2011-3393)	Nessus	Fedora Local Security Checks	high
51626	SuSE 11.1 Security Update : moonlight-plugin (SAT Patch Number 3606)	Nessus	SuSE Local Security Checks	high
51617	SuSE 11.1 Security Update : moonlight (SAT Patch Number 3728)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2010-4254

critical

Tenable Plugins

high

high

high

high

high