Vulnerability Bulletins |
Aumento de visibilidad en Mono |
|
Vulnerability classification |
|
| Property | Value |
| Confidence level | Oficial |
| Impact | Aumento de la visibilidad |
| Dificulty | Experto |
| Required attacker level | Acceso remoto sin cuenta a un servicio exotico |
System information |
|
| Property | Value |
| Affected manufacturer | UNIX |
| Affected software | Mono |
Description |
|
|
Se ha descubierto una vulnerabilidad en Mono. La vulnerabilidad reside en un error en la clase System.Web en XSP para el servidor ASP.NET 1.1 hasta la versión 2.0 que no verifica correctamente los nombres de ruta locales. Un atacante remoto podría leer código fuente añadiendo un espacio (%20) en la dirección URI, y leer credenciales mediante una petición a Web.Config%20. |
|
Solution |
|
|
Actualización de software Mandriva Mandriva Linux 2007 X86 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/i586/jay-1.1.17.1-5.2mdv2007.0.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/i586/libmono-runtime-1.1.17.1-5.2mdv2007.0.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/i586/libmono0-1.1.17.1-5.2mdv2007.0.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/i586/libmono0-devel-1.1.17.1-5.2mdv2007.0.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/i586/mono-1.1.17.1-5.2mdv2007.0.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/i586/mono-data-sqlite-1.1.17.1-5.2mdv2007.0.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/i586/mono-doc-1.1.17.1-5.2mdv2007.0.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/SRPMS/mono-1.1.17.1-5.2mdv2007.0.src.rpm X86_64 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/x86_64/jay-1.1.17.1-5.2mdv2007.0.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/x86_64/lib64mono0-1.1.17.1-5.2mdv2007.0.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/x86_64/lib64mono0-devel-1.1.17.1-5.2mdv2007.0.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/x86_64/libmono-runtime-1.1.17.1-5.2mdv2007.0.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/x86_64/mono-1.1.17.1-5.2mdv2007.0.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/x86_64/mono-data-sqlite-1.1.17.1-5.2mdv2007.0.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/x86_64/mono-doc-1.1.17.1-5.2mdv2007.0.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/SRPMS/mono-1.1.17.1-5.2mdv2007.0.src.rpm Suse Linux Las actualizaciones pueden descargarse mediante YAST o del servidor FTP oficial de Suse Linux |
|
Standar resources |
|
| Property | Value |
| CVE | CVE-2006-6104 |
| BID | 21687 |
Other resources |
|
|
Mandriva Security Advisory (MDKSA-2006:234) http://www.mandriva.com/security/advisories?name=MDKSA-2006:234 SUSE Security Advisory (SUSE-SA:2007:002) http://www.novell.com/linux/security/advisories/2007_02_mono.html |
|
Version history |
||
| Version | Comments | Date |
| 1.0 | Aviso emitido | 2006-12-27 |
| 1.1 | Aviso emitido por Suse (SUSE-SA:2007:002) | 2007-01-10 |