Mono ASP.NET Implementation Padding Oracle Information Disclosure Vulnerability

Bugtraq ID:	44285
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 21 2010 12:00AM
Updated:	Oct 21 2010 12:00AM
Credit:	Thai Duong and Juliano Rizzo
Vulnerable:	Mono Mono 2.6.4 Mono Mono 2.4.2 .1 Mono Mono 2.4.2 Mono Mono 2.0 Mono Mono 1.2.5 2 Mono Mono 1.2.5 1 Mono Mono 1.1.18 Mono Mono 1.1.17 Mono Mono 1.1.13 Mono Mono 1.1.4 Mono Mono 1.0.5 Mono Mono 1.0 Mono Mono 2.8 Mono Mono 1.1.8.3 Mono Mono 1.1.17.1 Mono Mono 1.1.13.7 Mono Mono 1.1.13.6 Mono Mono 1.1.13.4
Not Vulnerable:

Mono ASP.NET Implementation Padding Oracle Information Disclosure Vulnerability

Mono is prone to an information-disclosure vulnerability in the Mono ASP.NET implementation.

Successful exploits will allow attackers to decrypt and gain access to potentially sensitive data encrypted by the server. Obtained information may aid in further attacks.

This issue affects Mono 1.x and 2.x.

Please note that this issue is related to the issue described in BID 43316 (Microsoft .NET Framework ASP.NET Padding Oracle Information Disclosure Vulnerability).

Mono ASP.NET Implementation Padding Oracle Information Disclosure Vulnerability

Multiple tools that leverage this issue are publicly available.

Mono ASP.NET Implementation Padding Oracle Information Disclosure Vulnerability

Solution:
Fixes are available in the GIT repository.

Mono ASP.NET Implementation Padding Oracle Information Disclosure Vulnerability

References:

• Practical Padding Oracle Attacks (netifera)
  
• ASP.NET Padding Oracle (Mono)