[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Full-disclosure] [ MDVSA-2009:268 ] mono
- To: full-disclosure@xxxxxxxxxxxxxxxxx
- Subject: [Full-disclosure] [ MDVSA-2009:268 ] mono
- From: security@xxxxxxxxxxxx
- Date: Mon, 12 Oct 2009 15:44:00 +0200
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2009:268
http://www.mandriva.com/security/
_______________________________________________________________________
Package : mono
Date : October 12, 2009
Affected: 2008.1, 2009.0, Enterprise Server 5.0
_______________________________________________________________________
Problem Description:
Multiple vulnerabilities has been found and corrected in mono:
Multiple cross-site scripting (XSS) vulnerabilities in the ASP.net
class libraries in Mono 2.0 and earlier allow remote attackers to
inject arbitrary web script or HTML via crafted attributes related to
(1) HtmlControl.cs (PreProcessRelativeReference), (2) HtmlForm.cs
(RenderAttributes), (3) HtmlInputButton (RenderAttributes),
(4) HtmlInputRadioButton (RenderAttributes), and (5) HtmlSelect
(RenderChildren) (CVE-2008-3422).
The XML HMAC signature system did not correctly check certain
lengths. If an attacker sent a truncated HMAC, it could bypass
authentication, leading to potential privilege escalation
(CVE-2009-0217).
This update fixes these vulnerabilities.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3422
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0217
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2008.1:
de6e265dd80c5f7654d7f1781b3376aa 2008.1/i586/jay-1.2.6-4.2mdv2008.1.i586.rpm
97452600ab02162347cf54328aabd7bd
2008.1/i586/libmono0-1.2.6-4.2mdv2008.1.i586.rpm
f2b1560754e944ca8c56afb1cfdd10b5
2008.1/i586/libmono-devel-1.2.6-4.2mdv2008.1.i586.rpm
6066d1f5a75d974bfb52080d88c99aa1 2008.1/i586/mono-1.2.6-4.2mdv2008.1.i586.rpm
60ac8f3516199746756973b6f2c88281
2008.1/i586/mono-bytefx-data-mysql-1.2.6-4.2mdv2008.1.i586.rpm
fa88de113c3eae5911d5269656e0f7ae
2008.1/i586/mono-data-1.2.6-4.2mdv2008.1.i586.rpm
e2cf3a1bec78c70d3e923fe6cfd6657d
2008.1/i586/mono-data-firebird-1.2.6-4.2mdv2008.1.i586.rpm
4d6f885af6d50ac55fbce71bfb5d7cd3
2008.1/i586/mono-data-oracle-1.2.6-4.2mdv2008.1.i586.rpm
a04a52cd15bc0ece596a3aefc748583b
2008.1/i586/mono-data-postgresql-1.2.6-4.2mdv2008.1.i586.rpm
ec526c8f8f1ff2c55c8f68ddc80440ac
2008.1/i586/mono-data-sqlite-1.2.6-4.2mdv2008.1.i586.rpm
42c6c3df6268fe5823151258aec47f21
2008.1/i586/mono-data-sybase-1.2.6-4.2mdv2008.1.i586.rpm
8dbf5a4694b0b0849dfb4db338a495b1
2008.1/i586/mono-doc-1.2.6-4.2mdv2008.1.i586.rpm
78e393239b960afa6c21758a18792b56
2008.1/i586/mono-extras-1.2.6-4.2mdv2008.1.i586.rpm
8166a539f5f63fb85feaeb5e6d4888d3
2008.1/i586/mono-ibm-data-db2-1.2.6-4.2mdv2008.1.i586.rpm
48506beebc8f97bbb72b8ae6c802f56e
2008.1/i586/mono-jscript-1.2.6-4.2mdv2008.1.i586.rpm
9984610d5485bdbd5daeb4cb1844ec7a
2008.1/i586/mono-locale-extras-1.2.6-4.2mdv2008.1.i586.rpm
a29437ca4e9718ec03274791754d7eb8
2008.1/i586/mono-nunit-1.2.6-4.2mdv2008.1.i586.rpm
350eaa5dcbdc29ba80b393abbe6cc4d3
2008.1/i586/mono-web-1.2.6-4.2mdv2008.1.i586.rpm
209c1d3721b1dd3344f3cf9fa4e5c4d8
2008.1/i586/mono-winforms-1.2.6-4.2mdv2008.1.i586.rpm
35c1fbf300b903d847c6545f9b10702a 2008.1/SRPMS/mono-1.2.6-4.2mdv2008.1.src.rpm
Mandriva Linux 2008.1/X86_64:
edc5a920e6b80e4ecf3d6ce792d3f272
2008.1/x86_64/jay-1.2.6-4.2mdv2008.1.x86_64.rpm
602c11d794ecc88275dc41c72467bbfa
2008.1/x86_64/lib64mono0-1.2.6-4.2mdv2008.1.x86_64.rpm
6e9cf2b10af360860e15141d7aae81b0
2008.1/x86_64/lib64mono-devel-1.2.6-4.2mdv2008.1.x86_64.rpm
4ae0c0472dbf89975804afec253fcece
2008.1/x86_64/mono-1.2.6-4.2mdv2008.1.x86_64.rpm
3e142d74f0f323b18f8041df29d9af23
2008.1/x86_64/mono-bytefx-data-mysql-1.2.6-4.2mdv2008.1.x86_64.rpm
72923b3d6c1ae03aaf7e7f112fb3985f
2008.1/x86_64/mono-data-1.2.6-4.2mdv2008.1.x86_64.rpm
6669388d97d8870e4ae1aac4561d437a
2008.1/x86_64/mono-data-firebird-1.2.6-4.2mdv2008.1.x86_64.rpm
ff3b71cf21ede8bb278b22943032efc8
2008.1/x86_64/mono-data-oracle-1.2.6-4.2mdv2008.1.x86_64.rpm
41bf141eaa17dc71140292958c30a299
2008.1/x86_64/mono-data-postgresql-1.2.6-4.2mdv2008.1.x86_64.rpm
ffbe552fcc362ce25577b01bae7d2d17
2008.1/x86_64/mono-data-sqlite-1.2.6-4.2mdv2008.1.x86_64.rpm
1ddfa0b0eb1fb021616cac7e539ebe15
2008.1/x86_64/mono-data-sybase-1.2.6-4.2mdv2008.1.x86_64.rpm
71728b6881d74243161d09b8bb287272
2008.1/x86_64/mono-doc-1.2.6-4.2mdv2008.1.x86_64.rpm
8b0b39af45958b8999d5cb4f835d22d6
2008.1/x86_64/mono-extras-1.2.6-4.2mdv2008.1.x86_64.rpm
3dbc4666c3dde4e7341d46a117f8e5c2
2008.1/x86_64/mono-ibm-data-db2-1.2.6-4.2mdv2008.1.x86_64.rpm
6939c8e5a38e0007d9cb3467877f0a1b
2008.1/x86_64/mono-jscript-1.2.6-4.2mdv2008.1.x86_64.rpm
22e17b6fb762740073627357ab0bfc8d
2008.1/x86_64/mono-locale-extras-1.2.6-4.2mdv2008.1.x86_64.rpm
17c4ea75b0b538c0932fe465fff7c150
2008.1/x86_64/mono-nunit-1.2.6-4.2mdv2008.1.x86_64.rpm
c93ecadc53d94e8178a1aafce4e10795
2008.1/x86_64/mono-web-1.2.6-4.2mdv2008.1.x86_64.rpm
47a1d1f13e15c665af9f206112c4ad5b
2008.1/x86_64/mono-winforms-1.2.6-4.2mdv2008.1.x86_64.rpm
35c1fbf300b903d847c6545f9b10702a 2008.1/SRPMS/mono-1.2.6-4.2mdv2008.1.src.rpm
Mandriva Linux 2009.0:
e0d6b76674ada8d8115812770f236a31 2009.0/i586/jay-1.9.1-5.2mdv2009.0.i586.rpm
6654b5e9975aadba60b5339bf448d319
2009.0/i586/libmono0-1.9.1-5.2mdv2009.0.i586.rpm
2ae9180d639ca8acef99e5505e0a723f
2009.0/i586/libmono-devel-1.9.1-5.2mdv2009.0.i586.rpm
8830c0d711b0a5f22663c1af83e58031 2009.0/i586/mono-1.9.1-5.2mdv2009.0.i586.rpm
13991eedda949b0b59aa9558bd80b04c
2009.0/i586/mono-bytefx-data-mysql-1.9.1-5.2mdv2009.0.i586.rpm
7459e64357612053ec09a396a8d2637e
2009.0/i586/mono-data-1.9.1-5.2mdv2009.0.i586.rpm
41fe40e084585b3c2451a7dc578f3f57
2009.0/i586/mono-data-firebird-1.9.1-5.2mdv2009.0.i586.rpm
282c251339ac838893e149e6fa0d44ba
2009.0/i586/mono-data-oracle-1.9.1-5.2mdv2009.0.i586.rpm
ebcfad00d396a4ddbd4a4153a47903ee
2009.0/i586/mono-data-postgresql-1.9.1-5.2mdv2009.0.i586.rpm
343fc5891a7e5836060273c92b6fbe52
2009.0/i586/mono-data-sqlite-1.9.1-5.2mdv2009.0.i586.rpm
5ac4ff0c231f3fe181248206df2b79b0
2009.0/i586/mono-data-sybase-1.9.1-5.2mdv2009.0.i586.rpm
d8002b980b8fa31da67695d5c35c76f3
2009.0/i586/mono-doc-1.9.1-5.2mdv2009.0.i586.rpm
6d2c21bcfdf8598747f68baba09d2566
2009.0/i586/mono-extras-1.9.1-5.2mdv2009.0.i586.rpm
285c0c2f519dd11df02107319009e296
2009.0/i586/mono-ibm-data-db2-1.9.1-5.2mdv2009.0.i586.rpm
13d8dc15f76d1a41c16e216b9995c16e
2009.0/i586/mono-jscript-1.9.1-5.2mdv2009.0.i586.rpm
1794c3603f7e1da8c2fe066a6365863c
2009.0/i586/mono-locale-extras-1.9.1-5.2mdv2009.0.i586.rpm
fe59d88f287ad3750e717f312a42169f
2009.0/i586/mono-nunit-1.9.1-5.2mdv2009.0.i586.rpm
e16b611dfd8bff53e5d55f64c5db3c19
2009.0/i586/mono-web-1.9.1-5.2mdv2009.0.i586.rpm
ff4bd4b44a41af44a61327ace6ad3993
2009.0/i586/mono-winforms-1.9.1-5.2mdv2009.0.i586.rpm
6bf61c4628334ae896a39aac879ec488 2009.0/SRPMS/mono-1.9.1-5.2mdv2009.0.src.rpm
Mandriva Linux 2009.0/X86_64:
44397754d5efd916bc63160c98a5242c
2009.0/x86_64/jay-1.9.1-5.2mdv2009.0.x86_64.rpm
7f4db85dd7ebc2bb5dc742542e3f1038
2009.0/x86_64/lib64mono0-1.9.1-5.2mdv2009.0.x86_64.rpm
9477e7451ce2647e21f0d76a02d6b150
2009.0/x86_64/lib64mono-devel-1.9.1-5.2mdv2009.0.x86_64.rpm
45a0af75bf5d38e4225cf6772d7493b4
2009.0/x86_64/mono-1.9.1-5.2mdv2009.0.x86_64.rpm
7d136b0b121069963056ee59b28b2358
2009.0/x86_64/mono-bytefx-data-mysql-1.9.1-5.2mdv2009.0.x86_64.rpm
11b8f40590007e37696476a87e20f9ac
2009.0/x86_64/mono-data-1.9.1-5.2mdv2009.0.x86_64.rpm
1c021b353b9161be331ae357275580a4
2009.0/x86_64/mono-data-firebird-1.9.1-5.2mdv2009.0.x86_64.rpm
c1bf6485fd05e383dc22add8891a988b
2009.0/x86_64/mono-data-oracle-1.9.1-5.2mdv2009.0.x86_64.rpm
e170da29cd49c1baf9f9022bb467f51f
2009.0/x86_64/mono-data-postgresql-1.9.1-5.2mdv2009.0.x86_64.rpm
fd77c0c80e213893200f936d16ef8370
2009.0/x86_64/mono-data-sqlite-1.9.1-5.2mdv2009.0.x86_64.rpm
74e5734487378fc1f61aada64bb8cef3
2009.0/x86_64/mono-data-sybase-1.9.1-5.2mdv2009.0.x86_64.rpm
509369912869f9eeb48a93e8315269c2
2009.0/x86_64/mono-doc-1.9.1-5.2mdv2009.0.x86_64.rpm
d9cf20071826147ab093b1d7f6f0cdd5
2009.0/x86_64/mono-extras-1.9.1-5.2mdv2009.0.x86_64.rpm
66f53ae6e054459509decc7a882e41c5
2009.0/x86_64/mono-ibm-data-db2-1.9.1-5.2mdv2009.0.x86_64.rpm
5a35a61d918b720a2368b081c2580609
2009.0/x86_64/mono-jscript-1.9.1-5.2mdv2009.0.x86_64.rpm
b6ca2074141ea2c8f934088562e86c52
2009.0/x86_64/mono-locale-extras-1.9.1-5.2mdv2009.0.x86_64.rpm
335fb2198bc64930ee4bc9d61a0b8aa4
2009.0/x86_64/mono-nunit-1.9.1-5.2mdv2009.0.x86_64.rpm
f13262bd50dead132f3ca0a768b7b531
2009.0/x86_64/mono-web-1.9.1-5.2mdv2009.0.x86_64.rpm
e684e230e2b2497e02cb652d711b6bfb
2009.0/x86_64/mono-winforms-1.9.1-5.2mdv2009.0.x86_64.rpm
6bf61c4628334ae896a39aac879ec488 2009.0/SRPMS/mono-1.9.1-5.2mdv2009.0.src.rpm
Mandriva Enterprise Server 5:
db42b5ed808be0011a597f3c2589b386 mes5/i586/jay-1.9.1-5.2mdvmes5.i586.rpm
2d268385c40286aa22eb96e117fe4622 mes5/i586/libmono0-1.9.1-5.2mdvmes5.i586.rpm
13e058ffc0ea426329c9cd89013b3627
mes5/i586/libmono-devel-1.9.1-5.2mdvmes5.i586.rpm
9c1d1f611a3b8eb415c867d3d378aaad mes5/i586/mono-1.9.1-5.2mdvmes5.i586.rpm
4018554a87b79a3070dce02f45667f34
mes5/i586/mono-bytefx-data-mysql-1.9.1-5.2mdvmes5.i586.rpm
84946820d4cb0a726b20f14e1b48d540 mes5/i586/mono-data-1.9.1-5.2mdvmes5.i586.rpm
c6eb247ab28b9509c946337c9decb798
mes5/i586/mono-data-firebird-1.9.1-5.2mdvmes5.i586.rpm
79f7bb9d6eb6c3792d0999afe6be52b9
mes5/i586/mono-data-oracle-1.9.1-5.2mdvmes5.i586.rpm
76ffac5f0bd6813f32f0aeccc99bd163
mes5/i586/mono-data-postgresql-1.9.1-5.2mdvmes5.i586.rpm
49b76c6a1e89a2c3f8236123b9286614
mes5/i586/mono-data-sqlite-1.9.1-5.2mdvmes5.i586.rpm
75104633b7bdbfb0cda696e38c29ac19
mes5/i586/mono-data-sybase-1.9.1-5.2mdvmes5.i586.rpm
b9a12a97736edb66ae7a12a4f25f4f9f mes5/i586/mono-doc-1.9.1-5.2mdvmes5.i586.rpm
a837000f710729b7feaa3f09de4373c1
mes5/i586/mono-extras-1.9.1-5.2mdvmes5.i586.rpm
880955a3e86ec3079bf2576c12c3162a
mes5/i586/mono-ibm-data-db2-1.9.1-5.2mdvmes5.i586.rpm
9e566a11736724d34b29640e19ff2bc2
mes5/i586/mono-jscript-1.9.1-5.2mdvmes5.i586.rpm
2d5f001303e34a3060f0dcde99c6c0cd
mes5/i586/mono-locale-extras-1.9.1-5.2mdvmes5.i586.rpm
045bdf7a5129d9e3c291fe221e084783
mes5/i586/mono-nunit-1.9.1-5.2mdvmes5.i586.rpm
82d546afb360af149e0888c475cdea92 mes5/i586/mono-web-1.9.1-5.2mdvmes5.i586.rpm
d929e634482b68b9a15df22468a74399
mes5/i586/mono-winforms-1.9.1-5.2mdvmes5.i586.rpm
190fdc4f05bee8ee54978a48e4b3c84c mes5/SRPMS/mono-1.9.1-5.2mdvmes5.src.rpm
Mandriva Enterprise Server 5/X86_64:
c7e27bc486f4aadf9dcf136232ae9bde mes5/x86_64/jay-1.9.1-5.2mdvmes5.x86_64.rpm
5825aae16f52bb418a30b26f7090fab8
mes5/x86_64/lib64mono0-1.9.1-5.2mdvmes5.x86_64.rpm
067316d476e010019091116a8a3ebfd8
mes5/x86_64/lib64mono-devel-1.9.1-5.2mdvmes5.x86_64.rpm
c08589d0e6974670f2f9a93b333b8a9f mes5/x86_64/mono-1.9.1-5.2mdvmes5.x86_64.rpm
3e8b1230173c5a01283fec210f26f508
mes5/x86_64/mono-bytefx-data-mysql-1.9.1-5.2mdvmes5.x86_64.rpm
2b38f64c31b91c817546917aa6c0e947
mes5/x86_64/mono-data-1.9.1-5.2mdvmes5.x86_64.rpm
50ad3c92bb9f0bbb49f8919cd63fcfdd
mes5/x86_64/mono-data-firebird-1.9.1-5.2mdvmes5.x86_64.rpm
04ef75339343cf01b8f1e67e6d40407d
mes5/x86_64/mono-data-oracle-1.9.1-5.2mdvmes5.x86_64.rpm
ef21f7f6130b2e350bc7bd659d1b5d3d
mes5/x86_64/mono-data-postgresql-1.9.1-5.2mdvmes5.x86_64.rpm
d29808f8ab9b9e1f7611ae0ab168dfcf
mes5/x86_64/mono-data-sqlite-1.9.1-5.2mdvmes5.x86_64.rpm
df058be839da9c929fe5a6d843f73fbb
mes5/x86_64/mono-data-sybase-1.9.1-5.2mdvmes5.x86_64.rpm
8c08cf45c6c421df0f1aa22e1da254e3
mes5/x86_64/mono-doc-1.9.1-5.2mdvmes5.x86_64.rpm
d6fafb66dd6ffcd5fdf162bea6f90bfe
mes5/x86_64/mono-extras-1.9.1-5.2mdvmes5.x86_64.rpm
b45a4c26a149534f8b117a3c37786a3e
mes5/x86_64/mono-ibm-data-db2-1.9.1-5.2mdvmes5.x86_64.rpm
f7fb216b771981fab74b5c6960e9a4ef
mes5/x86_64/mono-jscript-1.9.1-5.2mdvmes5.x86_64.rpm
23ad9696709cf323c7ca13f1451a7d9a
mes5/x86_64/mono-locale-extras-1.9.1-5.2mdvmes5.x86_64.rpm
b26a99c1bc4bf952d8b78d3fa08abd7c
mes5/x86_64/mono-nunit-1.9.1-5.2mdvmes5.x86_64.rpm
7e8fa9d18335228bd732a94ffc6824b5
mes5/x86_64/mono-web-1.9.1-5.2mdvmes5.x86_64.rpm
e8d247c376a6c619557cf6c18a1772e1
mes5/x86_64/mono-winforms-1.9.1-5.2mdvmes5.x86_64.rpm
190fdc4f05bee8ee54978a48e4b3c84c mes5/SRPMS/mono-1.9.1-5.2mdvmes5.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFK0wUumqjQ0CJFipgRArNBAKCfWpGeVJIWtuSj4ffAx7FD7HWKLgCcCgs5
WU1penl7VZFFTdjrq8mGMCk=
=JIdr
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/