Cross-site scripting (XSS) vulnerability in the ProcessRequest function in mcs/class/System.Web/System.Web/HttpForbiddenHandler.cs in Mono 2.10.8 and earlier allows remote attackers to inject arbitrary web script or HTML via a file with a crafted name and a forbidden extension, which is not properly handled in an error message.

Mono was updated to fix :

A cross site scripting attack in the System.Web class 'forbidden extensions' filtering was fixed. (CVE-2012-3382)

Mono was updated to fix a cross-site scripting attack in the System.Web class 'forbidden extensions' filtering has been fixed.
(CVE-2012-3382)

A vulnerability has been discovered and corrected in mono :

Cross-site scripting (XSS) vulnerability in the ProcessRequest function in mcs/class/System.Web/System.Web/HttpForbiddenHandler.cs in Mono 2.10.8 and earlier allows remote attackers to inject arbitrary web script or HTML via a file with a crafted name and a forbidden extension, which is not properly handled in an error message (CVE-2012-3382).

The updated packages have been patched to correct this issue.

It was discovered that the Mono System.Web library incorrectly filtered certain error messages related to forbidden files. If a user were tricked into opening a specially crafted URL, an attacker could possibly exploit this to conduct cross-site scripting (XSS) attacks.
(CVE-2012-3382)

It was discovered that the Mono System.Web library incorrectly handled the EnableViewStateMac property. If a user were tricked into opening a specially crafted URL, an attacker could possibly exploit this to conduct cross-site scripting (XSS) attacks. This issue only affected Ubuntu 10.04 LTS. (CVE-2010-4159).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Marcus Meissner discovered that the web server included in Mono performed insufficient sanitising of requests, resulting in cross-site scripting.

The remote host is running a web server that fails to adequately sanitize request strings of malicious JavaScript. A remote attacker can exploit this issue, via a specially crafted request, to execute arbitrary HTML and script code in a user's browser within the security context of the affected site.

ID	Name	Product	Family	Severity
74707	openSUSE Security Update : mono-web (openSUSE-SU-2012:0974-1)	Nessus	SuSE Local Security Checks	medium
64118	SuSE 11.2 Security Update : Mono (SAT Patch Number 6543)	Nessus	SuSE Local Security Checks	medium
61985	Mandriva Linux Security Advisory : mono (MDVSA-2012:140)	Nessus	Mandriva Local Security Checks	medium
60126	Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : mono vulnerabilities (USN-1517-1)	Nessus	Ubuntu Local Security Checks	medium
60003	Debian DSA-2512-1 : mono - missing input sanitising	Nessus	Debian Local Security Checks	medium
10815	Web Server Generic XSS	Nessus	CGI abuses : XSS	medium

Detections

Analytics

CVE-2012-3382

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium