The RuntimeHelpers.InitializeArray method in metadata/icall.c in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, does not properly restrict data types, which allows remote attackers to modify internal read-only data structures, and cause a denial of service (plugin crash) or corrupt the internal state of the security manager, via a crafted media file, as demonstrated by modifying a C# struct.

Moonlight was prone to several security problems :

CVE-2011-0989: modification of read-only values via RuntimeHelpers.InitializeArray CVE-2011-0990: buffer overflow due to race condition in in Array.FastCopy CVE-2011-0991: use-after-free due to DynamicMethod resurrection CVE-2011-0992: information leak due to improper thread finalization

The remote host is affected by the vulnerability described in GLSA-201206-13 (Mono: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mono and Mono debugger.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could execute arbitrary code, bypass general       constraints, obtain the source code for .aspx applications, obtain other       sensitive information, cause a Denial of Service, modify internal data       structures, or corrupt the internal state of the security manager.
    A local attacker could entice a user into running Mono debugger in a       directory containing a specially crafted library file to execute       arbitrary code with the privileges of the user running Mono debugger.
    A context-dependent attacker could bypass the authentication mechanism       provided by the XML Signature specification.
  Workaround :

    There is no known workaround at this time.

Moonlight was prone to several security problems :

  - modification of read-only values via     RuntimeHelpers.InitializeArray. (CVE-2011-0989)

  - buffer overflow due to race condition in in     Array.FastCopy. (CVE-2011-0990)

  - use-after-free due to DynamicMethod resurrection.
    (CVE-2011-0991)

  - information leak due to improper thread finalization     These issues have been fixed. (CVE-2011-0992)

ID	Name	Product	Family	Severity
75903	openSUSE Security Update : libmoon-devel (openSUSE-SU-2011:0313-1)	Nessus	SuSE Local Security Checks	medium
75588	openSUSE Security Update : libmoon-devel (openSUSE-SU-2011:0313-1)	Nessus	SuSE Local Security Checks	medium
59651	GLSA-201206-13 : Mono: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
53314	SuSE 11.1 Security Update : moonlight (SAT Patch Number 4246)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2011-0989

high

Tenable Plugins

medium

medium

high

medium