CVE-2006-6104

Published: Dec 21, 2006Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to (1) read source code by appending a space (%20) to a URI, and (2) read credentials via a request for Web.Config%20.

Affected (3)

Products: Mono: Xsp

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Mono Xsp	Version 1.1
Mono Xsp	Version 1.2.1
Mono Xsp	Version 2.0

References (40)

http://fedoranews.org/cms/node/2400

Source: secalert@redhat.com

http://fedoranews.org/cms/node/2401

Source: secalert@redhat.com

http://lists.suse.com/archive/suse-security-announce/2007-Jan/0002.html

Source: secalert@redhat.com

http://secunia.com/advisories/23432

Source: secalert@redhat.com

ExploitPatchVendor Advisory

http://secunia.com/advisories/23435

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/23462

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/23597

Source: secalert@redhat.com

http://secunia.com/advisories/23727

Source: secalert@redhat.com

http://secunia.com/advisories/23776

Source: secalert@redhat.com

http://secunia.com/advisories/23779

Source: secalert@redhat.com

http://security.gentoo.org/glsa/glsa-200701-12.xml

Source: secalert@redhat.com

http://securityreason.com/securityalert/2082

Source: secalert@redhat.com

http://securitytracker.com/id?1017430

Source: secalert@redhat.com

http://www.eazel.es/advisory007-mono-xsp-source-disclosure-vulnerability.html

Source: secalert@redhat.com

Exploit

http://www.mandriva.com/security/advisories?name=MDKSA-2006:234

Source: secalert@redhat.com

PatchVendor Advisory

http://www.securityfocus.com/archive/1/454962/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/21687

Source: secalert@redhat.com

ExploitPatch

http://www.ubuntu.com/usn/usn-397-1

Source: secalert@redhat.com

Patch

http://www.vupen.com/english/advisories/2006/5099

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2092

Source: secalert@redhat.com

http://fedoranews.org/cms/node/2400

Source: af854a3a-2127-422b-91ae-364da2661108

http://fedoranews.org/cms/node/2401

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.suse.com/archive/suse-security-announce/2007-Jan/0002.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/23432

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatchVendor Advisory

http://secunia.com/advisories/23435

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://secunia.com/advisories/23462

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://secunia.com/advisories/23597

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/23727

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/23776

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/23779

Source: af854a3a-2127-422b-91ae-364da2661108

http://security.gentoo.org/glsa/glsa-200701-12.xml

Source: af854a3a-2127-422b-91ae-364da2661108

http://securityreason.com/securityalert/2082

Source: af854a3a-2127-422b-91ae-364da2661108

http://securitytracker.com/id?1017430

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.eazel.es/advisory007-mono-xsp-source-disclosure-vulnerability.html

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.mandriva.com/security/advisories?name=MDKSA-2006:234

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.securityfocus.com/archive/1/454962/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/21687

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

http://www.ubuntu.com/usn/usn-397-1

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.vupen.com/english/advisories/2006/5099

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2092

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.