Published: 04/09/2008 Updated: 11/10/2018

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 435

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

CRLF injection vulnerability in Sys.Web in Mono 2.0 and previous versions allows remote malicious users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the query string.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mono mono 1.0.5
mono mono 1.1.13
mono mono 1.2.5.1
mono project mono 1.2.1
mono project mono
mono mono 1.1.17.1
mono mono 1.0
mono mono 1.1.4
mono mono 1.1.8.3
mono project mono 1.2.6
mono project mono 1.9
mono mono 1.1.17
mono mono 1.1.18
mono project mono 1.2.4
mono project mono 1.2.5
mono mono 1.1.13.4
mono mono 1.1.13.6
mono mono 1.1.13.7
mono project mono 1.2.2
mono project mono 1.2.3

It was discovered that the XML HMAC signature system did not correctly check certain lengths If an attacker sent a truncated HMAC, it could bypass authentication, leading to potential privilege escalation (CVE-2009-0217) ...

Debian Bug report logs - #494406 CVE-2008-3422: Multiple Cross-site scripting (XSS) vulnerabilities Package: mono; Maintainer for mono is Debian Mono Group <pkg-mono-group@listsaliothdebianorg>; Reported by: Steffen Joeris <steffenjoeris@skolelinuxde> Date: Sat, 9 Aug 2008 06:57:01 UTC Severity: important Tags: ...

Debian Bug report logs - #498894 mono: CRLF injection vulnerability Package: mono; Maintainer for mono is Debian Mono Group <pkg-mono-group@listsaliothdebianorg>; Reported by: Steffen Joeris <steffenjoeris@skolelinuxde> Date: Sun, 14 Sep 2008 09:46:20 UTC Severity: important Tags: security Fixed in version mono ...

source: wwwsecurityfocuscom/bid/30867/info Mono is prone to a vulnerability that allows attackers to inject arbitrary HTTP headers because it fails to sanitize input By inserting arbitrary headers into an HTTP response, attackers may be able to launch cross-site request-forgery, cross-site scripting, HTTP-request-smuggling, and other at ...

CWE-20 http://www.openwall.com/lists/oss-security/2008/08/27/6 https://bugzilla.novell.com/show_bug.cgi?id=418620 http://www.securityfocus.com/bid/30867 http://secunia.com/advisories/31643 http://www.mandriva.com/security/advisories?name=MDVSA-2008:210 http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0286 http://secunia.com/advisories/36494 http://www.vupen.com/english/advisories/2008/2443 https://exchange.xforce.ibmcloud.com/vulnerabilities/44740 https://usn.ubuntu.com/826-1/http://www.securityfocus.com/archive/1/496845/100/0/threaded https://usn.ubuntu.com/826-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/32303/

CVE-2008-3906

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect