full-disclosure - [PLSA 2008-32] Mono: Cross Site Scripting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <48B9EC42.7010606@pardus.org.tr>
Date: Sun, 31 Aug 2008 03:56:34 +0300
From: Pınar Yanardağ <pinar@...dus.org.tr>
To: pardus-security@...dus.org.tr
Cc: full-disclosure@...ts.grok.org.uk
Subject: [PLSA 2008-32] Mono: Cross Site Scripting

------------------------------------------------------------------------
Pardus Linux Security Advisory 2008-32            security@...dus.org.tr
------------------------------------------------------------------------
       Date: 2008-08-31
   Severity: 2
       Type: Remote
------------------------------------------------------------------------

Summary
=======

Juraj Skripsky has reported a  vulnerability  in  Mono,  which  can  be
exploited by malicious people to conduct HTTP header injection attacks.

Description
===========

The vulnerability is caused due to  the  Sys.Web  module  not  properly
sanitising certain parameters before using them in HTTP responses. This
can be exploited to inject arbitrary HTML and  script  code,  which  is
executed in a user's browser session in context of an affected site.

Affected packages:

   Pardus 2008:
     mono, all before 1.2.6-17-2

Resolution
==========

There are update(s) for mono. You can update them via Package Manager or
with a single command from console:

     pisi up mono

References
==========

   * http://bugs.pardus.org.tr/show_bug.cgi?id=8069
   * https://bugzilla.novell.com/show_bug.cgi?id=418620
   * http://secunia.com/advisories/31643/

------------------------------------------------------------------------

-- 
Pınar Yanardağ
Pardus Security Team
http://security.pardus.org.tr

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/