The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to (1) read source code by appending a space (%20) to a URI, and (2) read credentials via a request for Web.Config%20.

Jose Ramon Palanco discovered that the mono System.Web class did not consistently verify local file paths. As a result, the source code for mono web applications could be retrieved remotely, possibly leading to further compromise via the application's source.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

XSP (the Mono ASP.NET server) is vulnerable to source disclosure attack which allow a malicious user to obtain the source code of the server-side application. This vulnerability grants the attacker deeper knowledge of the Web application logic.

Updated packages have been patched to correct this issue.

The remote host is affected by the vulnerability described in GLSA-200701-12 (Mono: Information disclosure)

    Jose Ramon Palanco has discovered that the System.Web class in the XSP     for the ASP.NET server 1.1 through 2.0 in Mono does not properly     validate or sanitize local pathnames which could allow server-side file     content disclosure.
  Impact :

    An attacker could append a space character to a URI and obtain     unauthorized access to the source code of server-side files. An     attacker could also read credentials by requesting Web.Config%20 from a     Mono server.
  Workaround :

    There is no known workaround at this time.

A security problem was found and fixed in mono class libraries that affects the Mono web server implementation.

By appending spaces to URLs attackers could download the source code of ASP.net scripts that would normally get executed by the web server.

After upgrading the packages you need to restart any running mono web server.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running Mono XSP, a lightweight web server for hosting ASP.NET applications. 

The version of Mono XSP installed on the remote Windows host fails to properly validate filename extensions in URLs.  A remote attacker may be able to leverage this issue to disclose the source of scripts hosted by the affected application using specially crafted requests with URL-encoded space characters.

ID	Name	Product	Family	Severity
27983	Ubuntu 6.06 LTS / 6.10 : mono vulnerability (USN-397-1)	Nessus	Ubuntu Local Security Checks	medium
24617	Mandrake Linux Security Advisory : mono (MDKSA-2006:234)	Nessus	Mandriva Local Security Checks	medium
24210	GLSA-200701-12 : Mono: Information disclosure	Nessus	Gentoo Local Security Checks	medium
24198	Fedora Core 5 : mono-1.1.13.7-3.fc5.1 (2007-068)	Nessus	Fedora Local Security Checks	medium
24197	Fedora Core 6 : mono-1.1.17.1-4.fc6 (2007-067)	Nessus	Fedora Local Security Checks	medium
23934	Mono XSP for ASP.NET Server Crafted Request Script Source Code Disclosure	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2006-6104

high

Tenable Plugins

medium

medium

medium

medium

medium

medium