The System.CodeDom.Compiler classes in Novell Mono create temporary files with insecure permissions, which allows local users to overwrite arbitrary files or execute arbitrary code via a symlink attack.

Sebastian Krahmer of the SuSE security team discovered that the System.CodeDom.Compiler classes used temporary files in an insecure way. This could allow a symbolic link attack to create or overwrite arbitrary files with the privileges of the user invoking the program.
Under some circumstances, a local attacker could also exploit this to inject arbitrary code into running Mono processes.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Sebastian Krahmer of the SUSE security team found that the System.CodeDom.Compiler classes in mono used temporary files in an insecure way that could allow a symbolic link attack to overwrite arbitrary files with the privileges of the user running a program that made use of those classes.

Updated packages have been patched to correct this issue.

A security problem was found and fixed in mono class libraries that affects the Mono web server implementation.

By appending spaces to URLs attackers could download the source code of ASP.net scripts that would normally get executed by the web server.

After upgrading the packages you need to restart any running mono web server.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200611-23 (Mono: Insecure temporary file creation)

    Sebastian Krahmer of the SuSE Security Team discovered that the     System.CodeDom.Compiler classes of Mono create temporary files with     insecure permissions.
  Impact :

    A local attacker could create links in the temporary file directory,     pointing to a valid file somewhere on the filesystem. When an affected     class is called, this could result in the file being overwritten with     the rights of the user running the script.
  Workaround :

    There is no known workaround at this time.

Sebastian Krahmer reports :

Sebastian Krahmer of the SuSE security team discovered that the System.CodeDom.Compiler classes used temporary files in an insecure way. This could allow a symbolic link attack to create or overwrite arbitrary files with the privileges of the user invoking the program.
Under some circumstances, a local attacker could also exploit this to inject arbitrary code into running Mono processes.

ID	Name	Product	Family	Severity
27937	Ubuntu 5.10 / 6.06 LTS : mono vulnerability (USN-357-1)	Nessus	Ubuntu Local Security Checks	medium
24573	Mandrake Linux Security Advisory : mono (MDKSA-2006:188)	Nessus	Mandriva Local Security Checks	medium
24198	Fedora Core 5 : mono-1.1.13.7-3.fc5.1 (2007-068)	Nessus	Fedora Local Security Checks	medium
23745	GLSA-200611-23 : Mono: Insecure temporary file creation	Nessus	Gentoo Local Security Checks	medium
22516	FreeBSD : mono -- 'System.CodeDom.Compiler' Insecure Temporary Creation (5a39a22e-5478-11db-8f1a-000a48049292)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2006-5072

high

Tenable Plugins

medium

medium

medium

medium

medium