CVE-2008-3906

Published: 4 September 2008

CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the query string.

Notes

Author	Note
mdeslaur	PoC in novell bug

Priority

Status

Package	Release	Status
mono Launchpad, Ubuntu, Debian	dapper	Ignored (end of life)
	feisty	Ignored (end of life, was needed)
	gutsy	Ignored (end of life, was needed)
	hardy	Released (1.2.6+dfsg-6ubuntu3.1)
	intrepid	Not vulnerable (1.9.1+dfsg-4ubuntu2)
	jaunty	Not vulnerable (2.0.1-4)
	upstream	Needs triage
	Patches: vendor: http://svn.debian.org/wsvn/pkg-mono/migrated-to-git/mono/trunk/debian/patches/fix_CRLF_injection_CVE-2008-3906.dpatch upstream: http://anonsvn.mono-project.com/viewvc?view=rev&revision=111116 upstream: http://anonsvn.mono-project.com/viewvc?view=rev&revision=111125 upstream: http://anonsvn.mono-project.com/viewvc?view=rev&revision=111117 upstream: http://anonsvn.mono-project.com/viewvc?view=rev&revision=111126 upstream: http://anonsvn.mono-project.com/viewvc?view=rev&revision=111118 upstream: http://anonsvn.mono-project.com/viewvc?view=rev&revision=111127 upstream: http://anonsvn.mono-project.com/viewvc?view=rev&revision=111119 upstream: http://anonsvn.mono-project.com/viewvc?view=rev&revision=111128 upstream: http://anonsvn.mono-project.com/viewvc?view=rev&revision=111120 upstream: http://anonsvn.mono-project.com/viewvc?view=rev&revision=111129 upstream: http://anonsvn.mono-project.com/viewvc?view=rev&revision=111104 upstream: http://anonsvn.mono-project.com/viewvc?view=rev&revision=111123 upstream: http://anonsvn.mono-project.com/viewvc?view=rev&revision=111103 upstream: http://anonsvn.mono-project.com/viewvc?view=rev&revision=111122

References

Bugs

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›