Untrusted search path vulnerability in metadata/loader.c in Mono 2.8 and earlier allows local users to gain privileges via a Trojan horse shared library in the current working directory.

It was discovered that the Mono System.Web library incorrectly filtered certain error messages related to forbidden files. If a user were tricked into opening a specially crafted URL, an attacker could possibly exploit this to conduct cross-site scripting (XSS) attacks.
(CVE-2012-3382)

It was discovered that the Mono System.Web library incorrectly handled the EnableViewStateMac property. If a user were tricked into opening a specially crafted URL, an attacker could possibly exploit this to conduct cross-site scripting (XSS) attacks. This issue only affected Ubuntu 10.04 LTS. (CVE-2010-4159).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201206-13 (Mono: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mono and Mono debugger.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could execute arbitrary code, bypass general       constraints, obtain the source code for .aspx applications, obtain other       sensitive information, cause a Denial of Service, modify internal data       structures, or corrupt the internal state of the security manager.
    A local attacker could entice a user into running Mono debugger in a       directory containing a specially crafted library file to execute       arbitrary code with the privileges of the user running Mono debugger.
    A context-dependent attacker could bypass the authentication mechanism       provided by the XML Signature specification.
  Workaround :

    There is no known workaround at this time.

The following bug has been fixed :

  - mono loaded shared libraries from the current directory.
    (CVE-2010-4159)

The following bug has been fixed :

  - Mono loaded shared libraries from the current directory.
    (CVE-2010-4159)

The following security bugs have been fixed :

  - Mono was vulnerable to a padding oracle attack.
    (CVE-2010-3332)

  - Mono loaded shared libraries from the current directory.
    (CVE-2010-4159)

- CVE-2010-4159

    - CVE-2010-4254

    - mono-core and mono-addins do not depend on mono-devel       anymore

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability was discovered and corrected in mono :

Untrusted search path vulnerability in metadata/loader.c in Mono 2.8 and earlier allows local users to gain privileges via a Trojan horse shared library in the current working directory (CVE-2010-4159).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct this issue.

ID	Name	Product	Family	Severity
60126	Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : mono vulnerabilities (USN-1517-1)	Nessus	Ubuntu Local Security Checks	medium
59651	GLSA-201206-13 : Mono: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
57164	SuSE 10 Security Update : Mono (ZYPP Patch Number 7479)	Nessus	SuSE Local Security Checks	medium
53530	SuSE 10 Security Update : Mono (ZYPP Patch Number 7445)	Nessus	SuSE Local Security Checks	medium
53528	SuSE 11.1 Security Update : Mono (SAT Patch Number 4260)	Nessus	SuSE Local Security Checks	medium
53241	Fedora 14 : mono-2.6.7-4.fc14 / mono-addins-0.5-2.fc14 (2011-3393)	Nessus	Fedora Local Security Checks	high
50819	Mandriva Linux Security Advisory : mono (MDVSA-2010:240)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2010-4159

high

Tenable Plugins

medium

high

medium

medium

medium

high

medium