Mono 'HttpForbiddenHandler.cs' Cross-Site Scripting Vulnerability

Bugtraq ID:	54344
Class:	Input Validation Error
CVE:	CVE-2012-3382
Remote:	Yes
Local:	No
Published:	Jul 03 2012 12:00AM
Updated:	Aug 20 2012 02:00PM
Credit:	Marcus Meissner
Vulnerable:	Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 11.10 i386 Ubuntu Ubuntu Linux 11.10 amd64 Ubuntu Ubuntu Linux 11.04 powerpc Ubuntu Ubuntu Linux 11.04 i386 Ubuntu Ubuntu Linux 11.04 ARM Ubuntu Ubuntu Linux 11.04 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 Mandriva Linux Mandrake 2011 x86_64 Mandriva Linux Mandrake 2011 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

Mono 'HttpForbiddenHandler.cs' Cross-Site Scripting Vulnerability

Mono is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Mono 2.6.7 is vulnerable; other versions may also be affected.

Mono 'HttpForbiddenHandler.cs' Cross-Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting to victim to follow a malicious URI.

Mono 'HttpForbiddenHandler.cs' Cross-Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for more information.

Mono 'HttpForbiddenHandler.cs' Cross-Site Scripting Vulnerability

References:

• Mono Homepage (Mono)