Use-after-free vulnerability in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, allows remote attackers to cause a denial of service (plugin crash) or obtain sensitive information via vectors related to member data in a resurrected MonoThread instance.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2547-1 advisory.

    It was discovered that the Mono TLS implementation was vulnerable to the SKIP-TLS vulnerability. A remote     attacker could possibly use this issue to perform client impersonation attacks. (CVE-2015-2318)

    It was discovered that the Mono TLS implementation was vulnerable to the FREAK vulnerability. A remote     attacker or a machine-in-the-middle could possibly use this issue to force the use of insecure     ciphersuites. (CVE-2015-2319)

    It was discovered that the Mono TLS implementation still supported a fallback to SSLv2. This update     removes the functionality as use of SSLv2 is known to be insecure. (CVE-2015-2320)

    It was discovered that Mono incorrectly handled memory in certain circumstances. A remote attacker could     possibly use this issue to cause Mono to crash, resulting in a denial of service, or to obtain sensitive     information. This issue only applied to Ubuntu 12.04 LTS. (CVE-2011-0992)

    It was discovered that Mono incorrectly handled hash collisions. A remote attacker could possibly use this     issue to cause Mono to crash, resulting in a denial of service. This issue only applied to Ubuntu 12.04     LTS. (CVE-2012-3543)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Moonlight was prone to several security problems :

CVE-2011-0989: modification of read-only values via RuntimeHelpers.InitializeArray CVE-2011-0990: buffer overflow due to race condition in in Array.FastCopy CVE-2011-0991: use-after-free due to DynamicMethod resurrection CVE-2011-0992: information leak due to improper thread finalization

The remote host is affected by the vulnerability described in GLSA-201206-13 (Mono: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mono and Mono debugger.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could execute arbitrary code, bypass general       constraints, obtain the source code for .aspx applications, obtain other       sensitive information, cause a Denial of Service, modify internal data       structures, or corrupt the internal state of the security manager.
    A local attacker could entice a user into running Mono debugger in a       directory containing a specially crafted library file to execute       arbitrary code with the privileges of the user running Mono debugger.
    A context-dependent attacker could bypass the authentication mechanism       provided by the XML Signature specification.
  Workaround :

    There is no known workaround at this time.

Moonlight was prone to several security problems :

  - modification of read-only values via     RuntimeHelpers.InitializeArray. (CVE-2011-0989)

  - buffer overflow due to race condition in in     Array.FastCopy. (CVE-2011-0990)

  - use-after-free due to DynamicMethod resurrection.
    (CVE-2011-0991)

  - information leak due to improper thread finalization     These issues have been fixed. (CVE-2011-0992)

ID	Name	Product	Family	Severity
82074	Ubuntu 14.04 LTS : Mono vulnerabilities (USN-2547-1)	Nessus	Ubuntu Local Security Checks	critical
75903	openSUSE Security Update : libmoon-devel (openSUSE-SU-2011:0313-1)	Nessus	SuSE Local Security Checks	medium
75588	openSUSE Security Update : libmoon-devel (openSUSE-SU-2011:0313-1)	Nessus	SuSE Local Security Checks	medium
59651	GLSA-201206-13 : Mono: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
53314	SuSE 11.1 Security Update : moonlight (SAT Patch Number 4246)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2011-0992

high

Tenable Plugins

critical

medium

medium

high

medium