CVE-2006-6104
First published: Thu Dec 21 2006(Updated: )
The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to (1) read source code by appending a space (%20) to a URI, and (2) read credentials via a request for Web.Config%20.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mono Xsp | =1.1 | |
| Mono Xsp | =1.2.1 | |
| Mono Xsp | =2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.eazel.es/advisory007-mono-xsp-source-disclosure-vulnerability.html
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:234
- http://www.ubuntu.com/usn/usn-397-1
- http://www.securityfocus.com/bid/21687
- http://secunia.com/advisories/23432
- http://secunia.com/advisories/23435
- http://secunia.com/advisories/23462
- http://securitytracker.com/id?1017430
- http://lists.suse.com/archive/suse-security-announce/2007-Jan/0002.html
- http://secunia.com/advisories/23597
- http://fedoranews.org/cms/node/2400
- http://fedoranews.org/cms/node/2401
- http://security.gentoo.org/glsa/glsa-200701-12.xml
- http://secunia.com/advisories/23727
- http://secunia.com/advisories/23776
- http://secunia.com/advisories/23779
- http://securityreason.com/securityalert/2082
- http://www.vupen.com/english/advisories/2006/5099
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2092
- http://www.securityfocus.com/archive/1/454962/100/0/threaded
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/nvd-historical
- collector/nvd-index
- vendor/mono
- canonical/mono xsp
- version/mono xsp/1.1
- version/mono xsp/1.2.1
- version/mono xsp/2.0