Mono XSP Source Code Information Disclosure Vulnerability

BID:21687

Info

Mono XSP Source Code Information Disclosure Vulnerability

Bugtraq ID: 21687
Class: Input Validation Error
CVE: CVE-2006-6104
Remote: Yes
Local: No
Published: Dec 20 2006 12:00AM
Updated: Jan 26 2007 09:39PM
Credit: [email protected] is credited with the discovery of this vulnerability.
Vulnerable: Ubuntu Ubuntu Linux 6.10 sparc
Ubuntu Ubuntu Linux 6.10 powerpc
Ubuntu Ubuntu Linux 6.10 i386
Ubuntu Ubuntu Linux 6.10 amd64
Ubuntu Ubuntu Linux 6.06 LTS sparc
Ubuntu Ubuntu Linux 6.06 LTS powerpc
Ubuntu Ubuntu Linux 6.06 LTS i386
Ubuntu Ubuntu Linux 6.06 LTS amd64
SuSE SUSE Linux Enterprise Server 10
SuSE SUSE Linux Enterprise SDK 10
SuSE SUSE Linux Enterprise Desktop 10
S.u.S.E. openSUSE 10.2
S.u.S.E. Linux Professional 10.1
S.u.S.E. Linux Personal 10.1
Red Hat Fedora Core5
Mono XSP 1.2.1
Mono XSP 2.0
Mono XSP 1.1
Mono Mono 1.1.13.6
Mandriva Linux Mandrake 2007.0 x86_64
Mandriva Linux Mandrake 2007.0
Gentoo Linux
Not Vulnerable: Mono XSP 2.0 rev 68766

Discussion

Mono XSP Source Code Information Disclosure Vulnerability

XSP is prone to a source code information-disclosure vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the webserver process. Information obtained may aid in further attacks.

Exploit / POC

Mono XSP Source Code Information Disclosure Vulnerability

Attackers can exploit this vulnerability with a standard web browser.

An example URI has been provided:

http://www.example.com/app/Default.aspx%20

Solution / Fix

Mono XSP Source Code Information Disclosure Vulnerability

Solution:
The vendor has released subversion revision 68776 to address this issue; please see the references for more information.


Mono XSP 1.1

Mono XSP 2.0

S.u.S.E. openSUSE 10.2

S.u.S.E. Linux Professional 10.1

Mono Mono 1.1.13.6

Mono XSP 1.2.1

References

Mono XSP Source Code Information Disclosure Vulnerability

References:
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report