335617 – <dev-lang/mono-2.6.4: XSS vulnerability (CVE-2010-1459)

Bug 335617 - <dev-lang/mono-2.6.4: XSS vulnerability (CVE-2010-1459)

Summary: <dev-lang/mono-2.6.4: XSS vulnerability (CVE-2010-1459)

Status:	RESOLVED FIXED

Alias:	None

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	High minor (vote)
Assignee:	Gentoo Security

URL:	http://www.mono-project.com/Vulnerabi...
Whiteboard:	B3 [noglsa]
Keywords:

Depends on:
Blocks:

Reported:	2010-09-01 23:11 UTC by Stefan Behte (RETIRED)
Modified:	2011-01-27 00:49 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Stefan Behte (RETIRED) gentoo-dev

2010-09-01 23:11:06 UTC

CVE-2010-1459 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1459):
  The default configuration of ASP.NET in Mono before 2.6.4 has a value
  of FALSE for the EnableViewStateMac property, which allows remote
  attackers to conduct cross-site scripting (XSS) attacks, as
  demonstrated by the __VIEWSTATE parameter to 2.0/menu/menu1.aspx in
  the XSP sample project.

Comment 1 Tim Sammut (RETIRED) gentoo-dev

2011-01-27 00:49:35 UTC

Closing noglsa for XSS.