Buffer overflow in the Mono.Math.BigInteger class in Mono 1.2.5.1 and earlier allows context-dependent attackers to execute arbitrary code via unspecified vectors related to Reduce in Montgomery-based Pow methods.

Multiple vulnerabilities has been found and corrected in mono :

IOActive Inc. found a buffer overflow in Mono.Math.BigInteger class in Mono 1.2.5.1 and previous versions, which allows arbitrary code execution by context-dependent attackers (CVE-2007-5197).

Multiple cross-site scripting (XSS) vulnerabilities in the ASP.net class libraries in Mono 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via crafted attributes related to (1) HtmlControl.cs (PreProcessRelativeReference), (2) HtmlForm.cs (RenderAttributes), (3) HtmlInputButton (RenderAttributes), (4) HtmlInputRadioButton (RenderAttributes), and (5) HtmlSelect (RenderChildren) (CVE-2008-3422).

CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the query string (CVE-2008-3906).

The XML HMAC signature system did not correctly check certain lengths.
If an attacker sent a truncated HMAC, it could bypass authentication, leading to potential privilege escalation (CVE-2009-0217).

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

The updated packages have been patched to fix these issues.

This update fixes a buffer overflow in Mono's BigInteger implementation.

It was discovered that Mono did not correctly bounds check certain BigInteger actions. Remote attackers could exploit this to crash a Mono application or possibly execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

IOActive Inc. found a buffer overflow in Mono.Math.BigInteger class in Mono 1.2.5.1 and previous versions, which allows arbitrary code execution by context-dependent attackers.

Updated packages fix this issue.

A buffer overflow in the Mono.Math.BigInteger class in Mono allows attackers to execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200711-10 (Mono: Buffer overflow)

    IOActive discovered an error in the Mono.Math.BigInteger class, in the     reduction step of the Montgomery-based Pow methods, that could lead to     a buffer overflow.
  Impact :

    A remote attacker could exploit this vulnerability by sending specially     crafted data to Mono applications using the BigInteger class, which     might lead to the execution of arbitrary code with the privileges of     the user running the application (possibly root) or a Denial of     Service.
  Workaround :

    There is no known workaround at this time.

An integer overflow in the BigInteger data type implementation has been discovered in the free .NET runtime Mono.

The oldstable distribution (sarge) doesn't contain mono.

ID	Name	Product	Family	Severity
43041	Mandriva Linux Security Advisory : mono (MDVSA-2009:322)	Nessus	Mandriva Local Security Checks	high
29389	SuSE 10 Security Update : Mono (ZYPP Patch Number 4453)	Nessus	SuSE Local Security Checks	high
29238	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : mono vulnerability (USN-553-1)	Nessus	Ubuntu Local Security Checks	high
28223	Mandrake Linux Security Advisory : mono (MDKSA-2007:218)	Nessus	Mandriva Local Security Checks	high
28163	Fedora 7 : mono-1.2.3-5.fc7 (2007-3130)	Nessus	Fedora Local Security Checks	high
27827	GLSA-200711-10 : Mono: Buffer overflow	Nessus	Gentoo Local Security Checks	high
27821	Fedora 8 : mono-1.2.5.1-2.fc8 (2007-2969)	Nessus	Fedora Local Security Checks	high
27621	Debian DSA-1397-1 : mono - integer overflow	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2007-5197

critical

Tenable Plugins

high

high

high

high

high

high

high

high