CVE-2007-5473

The CVE-2007-5473 entry concerns Mono before 1.2.5.2. StaticFileHandler.cs in System.Web on Windows fails to properly handle a request trailing with a space or dot in XSP, allowing remote attackers to disclose source code of sensitive files. Affected component: Mono’s System.Web.StaticFileHandler...

CVE-2007-5473

StaticFileHandler.cs in System.Web in Mono before 1.2.5.2, when running on Windows, allows remote attackers to obtain source code of sensitive files via a request containing a trailing 1 space or 2 dot, which is not properly handled by XSP...

CVE-2007-5473: Exposure of Sensitive Information to an Unauthorized Actor

StaticFileHandler.cs in System.Web in Mono before 1.2.5.2, when running on Windows, allows remote attackers to obtain source code of sensitive files via a request containing a trailing 1 space or 2 dot, which is not properly handled by XSP...

openSUSE 10 Security Update : mono-core (mono-core-2182)

The Mono System.Xml.Serialization class contained a /tmp race which allows local attackers to potentially execute code as the user using the Serialization method. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSU...

openSUSE 10 Security Update : mono-core (mono-core-2392)

By appending spaces to URLs and attackers could download the source code of scripts that normally get executed by the web server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update mono-core-2392...

openSUSE 10 Security Update : mono-core (mono-core-2373)

By appending spaces to URLs and attackers could download the source code of scripts that normally get executed by the web server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update mono-core-2373...

Mandrake Linux Security Advisory : mono (MDKSA-2006:188)

Sebastian Krahmer of the SUSE security team found that the System.CodeDom.Compiler classes in mono used temporary files in an insecure way that could allow a symbolic link attack to overwrite arbitrary files with the privileges of the user running a program that made use of those classes. Updated...

SUSE-SA:2006:073: mono-core

The remote host is missing the patch for the advisory SUSE-SA:2006:073 mono-core. Sebastian Krahmer of SUSE Security found that the Mono System.Xml.Serialization class contained a /tmp race which potentially allows local attackers to execute code as the user using the Serialization method. This i...

Mandrake Linux Security Advisory : mono (MDKSA-2006:234)

XSP the Mono ASP.NET server is vulnerable to source disclosure attack which allow a malicious user to obtain the source code of the server-side application. This vulnerability grants the attacker deeper knowledge of the Web application logic. Updated packages have been patched to correct this...

Fedora Core 6 : mono-1.1.17.1-4.fc6 (2007-067)

A security problem was found and fixed in mono class libraries that affects the Mono web server implementation. By appending spaces to URLs attackers could download the source code of ASP.net scripts that would normally get executed by the web server. After upgrading the packages you need to...

Fedora Core 5 : mono-1.1.13.7-2.fc5.1 (2006-1012)

CVE-2006-5072 Mono insecure temporary file usage Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Fedora Core 5 : mono-1.1.13.7-3.fc5.1 (2007-068)

A security problem was found and fixed in mono class libraries that affects the Mono web server implementation. By appending spaces to URLs attackers could download the source code of ASP.net scripts that would normally get executed by the web server. After upgrading the packages you need to...

GLSA-200701-12 : Mono: Information disclosure

The remote host is affected by the vulnerability described in GLSA-200701-12 Mono: Information disclosure Jose Ramon Palanco has discovered that the System.Web class in the XSP for the ASP.NET server 1.1 through 2.0 in Mono does not properly validate or sanitize local pathnames which could allow...

Mono: Information disclosure

Background Mono provides the necessary software to develop and run .NET client and server applications on various platforms. Description Jose Ramon Palanco has discovered that the System.Web class in the XSP for the ASP.NET server 1.1 through 2.0 in Mono does not properly validate or sanitize loc...

[SECURITY] Fedora Core 5 Update: mono-1.1.13.7-3.fc5.1

The Mono runtime implements a JIT engine for the ECMA CLI virtual machine as well as a byte code interpreter, the class loader, the garbage collector, threading system and metadata access libraries...

[SECURITY] Fedora Core 6 Update: mono-1.1.17.1-4.fc6

The Mono runtime implements a JIT engine for the ECMA CLI virtual machine as well as a byte code interpreter, the class loader, the garbage collector, threading system and metadata access libraries...

Mono XSP for ASP.NET Server Crafted Request Script Source Code Disclosure

The remote host is running Mono XSP, a lightweight web server for hosting ASP.NET applications. The version of Mono XSP installed on the remote Windows host fails to properly validate filename extensions in URLs. A remote attacker may be able to leverage this issue to disclose the source of scrip...

CVE-2006-6104

The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to 1 read source code by appending a space %20 to a URI, and 2 read credentials via a request for Web.Config%20...

CVE-2006-6104

The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to 1 read source code by appending a space %20 to a URI, and 2 read credentials via a request for Web.Config%20...

CVE-2006-6104

The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to 1 read source code by appending a space %20 to a URI, and 2 read credentials via a request for Web.Config%20...