Published: 06/12/2010 Updated: 02/02/2011

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 755

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Mono, when Moonlight prior to 2.3.0.1 or 2.99.x prior to 2.99.0.10 is used, does not properly validate arguments to generic methods, which allows remote malicious users to bypass generic constraints, and possibly execute arbitrary code, via a crafted method call.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mono mono
novell moonlight 2.99.0
novell moonlight
novell moonlight 2.99.7
novell moonlight 2.99.9
novell moonlight 2.99.1
novell moonlight 2.99.2

Debian Bug report logs - #608288 mono: CVE-2010-4254 and CVE-2010-4225 Package: mono; Maintainer for mono is Debian Mono Group <pkg-mono-group@listsaliothdebianorg>; Reported by: Giuseppe Iuculano <iuculano@debianorg> Date: Wed, 29 Dec 2010 17:36:05 UTC Severity: serious Tags: security Fixed in version mono/26 ...

Sources: wwwchrishowiecom/2010/11/24/mutable-strings-in-mono/ wwwsecurityfocuscom/bid/45051/info Mono and Moonlight is prone to a local privilege-escalation vulnerability Local attackers can exploit this issue to execute arbitrary code with elevated privileges Successful exploits will compromise the affected application and ...

CWE-20 https://bugzilla.novell.com/show_bug.cgi?id=654136 https://bugzilla.novell.com/show_bug.cgi?id=655847 https://github.com/mono/mono/commit/65292a69c837b8a5f7a392d34db63de592153358 http://www.mono-project.com/Vulnerabilities#Moonlight_Generic_Constraints_Bypass_Vulnerability https://github.com/mono/mono/commit/cf1ec146f7c6acdc6697032b3aaafc68ffacdcac http://secunia.com/advisories/42373 https://github.com/mono/mono/commit/4905ef1130feb26c3150b28b97e4a96752e0d399 http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html http://www.vupen.com/english/advisories/2011/0076 http://www.securityfocus.com/bid/45051 http://secunia.com/advisories/42877 http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html http://www.exploit-db.com/exploits/15974 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=608288 https://nvd.nist.gov https://www.exploit-db.com/exploits/15974/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2010-4254

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect