Ubuntu 12.04 LTS: USN-1517-1 Moderate: Mono Information Exposure Issue

ubuntu

July 25, 2012

Mono could be made to expose sensitive information over the network.

Summary

Mono could be made to expose sensitive information over the network.

Software Description:

- mono: Mono is a platform for running and developing applications

Details:

It was discovered that the Mono System.Web library incorrectly filtered

certain error messages related to forbidden files. If a user were tricked

into opening a specially crafted URL, an attacker could possibly exploit

this to conduct cross-site scripting (XSS) attacks. (CVE-2012-3382)

It was discovered that the Mono System.Web library incorrectly handled the

EnableViewStateMac property. If a user were tricked into opening a

specially crafted URL, an attacker could possibly exploit this to conduct

cross-site scripting (XSS) attacks. This issue only affected Ubuntu

10.04 LTS. (CVE-2010-1459)

Topics Covered

security advisory software update cross-site scripting Ubuntu information exposure

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  libmono-system-web2.0-cil       2.10.8.1-1ubuntu2.2
  libmono-system-web4.0-cil       2.10.8.1-1ubuntu2.2

Ubuntu 11.10:
  libmono-system-web2.0-cil       2.10.5-1ubuntu0.1
  libmono-system-web4.0-cil       2.10.5-1ubuntu0.1

Ubuntu 11.04:
  libmono-system-web1.0-cil       2.6.7-5ubuntu3.1
  libmono-system-web2.0-cil       2.6.7-5ubuntu3.1

Ubuntu 10.04 LTS:
  libmono-system-web1.0-cil       2.4.4~svn151842-1ubuntu4.1
  libmono-system-web2.0-cil       2.4.4~svn151842-1ubuntu4.1

After a standard system update you need to restart Mono applications to
make all the necessary changes.