mono-web ASP.net sourcecode disclosure

The OVAL Repository 5.9 2012-01-27T05:11:22.933-05:00 mono-web ASP.net sourcecode disclosure openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 bytefx-data-mysql ibm-data-db2 mono-basic mono-core mono-core-32bit mono-data mono-data-firebird mono-data-oracle mono-data-postgresql mono-data-sqlite mono-data-sybase mono-devel mono-extras mono-jscript mono-locale-extras mono-nunit mono-web mono-winforms The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to (1) read source code by appending a space (%20) to a URI, and (2) read credentials via a request for Web.Config%20. Thomas R. Jones DRAFT INTERIM ACCEPTED Nicholas Hansen INTERIM Nicholas Hansen Nicholas Hansen Jeff Cheng Jeff Cheng Jeff Cheng ACCEPTED ACCEPTED cpe://novell:opensuse:10.2 cpe://novell:suse_linux:10.1 cpe://novell:suse_linux_enterprise:10:desktop cpe://novell:suse_linux_enterprise:10:server cpe:///novell:bytefx-data-mysql cpe:///novell:ibm-data-db2 cpe:///novell:mono-basic cpe:///novell:mono-core cpe:///novell:mono-core-32bit cpe:///novell:mono-data cpe:///novell:mono-data-firebird cpe:///novell:mono-data-oracle cpe:///novell:mono-data-postgresql cpe:///novell:mono-data-sqlite cpe:///novell:mono-data-sybase cpe:///novell:mono-devel cpe:///novell:mono-extras cpe:///novell:mono-jscript cpe:///novell:mono-locale-extras cpe:///novell:mono-nunit cpe:///novell:mono-web cpe:///novell:mono-winforms Package mono-basic is installed openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package mono-basic is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop Package ibm-data-db2 is installed openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package ibm-data-db2 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop Package bytefx-data-mysql is installed openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package bytefx-data-mysql is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop Package mono-data-postgresql is installed openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 Package mono-data-postgresql is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop cpe:/o:novell:suse_linux_enterprise:10::server Package mono-data-oracle is installed openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 Package mono-data-oracle is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop cpe:/o:novell:suse_linux_enterprise:10::server Package mono-jscript is installed openSUSE 10.2 SUSE Linux 10.1 Package mono-jscript is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 Package mono-data-firebird is installed openSUSE 10.2 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 Package mono-data-firebird is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop cpe:/o:novell:suse_linux_enterprise:10::server Package mono-extras is installed openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package mono-extras is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop SUSE Linux 10.1 is installed SUSE Linux 10.1 is installed. Thomas R. Jones DRAFT Jonathan Baker INTERIM ACCEPTED Nicholas Hansen INTERIM ACCEPTED ACCEPTED Package mono-data-sqlite is installed openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 Package mono-data-sqlite is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop cpe:/o:novell:suse_linux_enterprise:10::server Package mono-winforms is installed openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package mono-winforms is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop Package mono-nunit is installed openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 Package mono-nunit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop cpe:/o:novell:suse_linux_enterprise:10::server SUSE Linux Enterprise Desktop 10 is installed SUSE Linux Enterprise Desktop 10 is installed. Thomas R. Jones DRAFT Jonathan Baker INTERIM ACCEPTED Nicholas Hansen INTERIM ACCEPTED ACCEPTED Package mono-locale-extras is installed openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 Package mono-locale-extras is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop cpe:/o:novell:suse_linux_enterprise:10::server Package mono-devel is installed openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 Package mono-devel is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop Package mono-data-sybase is installed openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 Package mono-data-sybase is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop cpe:/o:novell:suse_linux_enterprise:10::server Package mono-data is installed openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 Package mono-data is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop cpe:/o:novell:suse_linux_enterprise:10::server Package mono-core is installed openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 Package mono-core is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop cpe:/o:novell:suse_linux_enterprise:10::server Package mono-web is installed openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 SUSE Linux Enterprise Desktop 10 SUSE Linux Enterprise Server 10 Package mono-web is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 cpe:/o:novell:suse_linux_enterprise:10::desktop cpe:/o:novell:suse_linux_enterprise:10::server SUSE Linux Enterprise Server 10 is installed SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Server 10 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED Nicholas Hansen INTERIM ACCEPTED ACCEPTED cpe:/o:novell:suse_linux:10:server Package mono-core-32bit is installed openSUSE 10.2 SUSE Linux 10.0 SUSE Linux 10.1 Package mono-core-32bit is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2 cpe:/o:novell:suse_linux:10.0 cpe:/o:novell:suse_linux:10.1 openSUSE 10.2 is installed openSUSE 10.2 openSUSE 10.2 is installed. Thomas R. Jones DRAFT INTERIM ACCEPTED Nicholas Hansen INTERIM ACCEPTED ACCEPTED cpe:/o:novell:opensuse:10.2