CVE-2006-6104

2006-12-2119:28:00

Debian Security Bug Tracker

security-tracker.debian.org

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

0.074

Percentile

94.2%

JSON

The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to (1) read source code by appending a space (%20) to a URI, and (2) read credentials via a request for Web.Config%20.

OSVersionArchitecturePackageVersionFilename
Debian12allmono< 1.2.2.1-1mono_1.2.2.1-1_all.deb
Debian11allmono< 1.2.2.1-1mono_1.2.2.1-1_all.deb
Debian999allmono< 1.2.2.1-1mono_1.2.2.1-1_all.deb
Debian13allmono< 1.2.2.1-1mono_1.2.2.1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	mono	< 1.2.2.1-1	mono_1.2.2.1-1_all.deb
Debian	11	all	mono	< 1.2.2.1-1	mono_1.2.2.1-1_all.deb
Debian	999	all	mono	< 1.2.2.1-1	mono_1.2.2.1-1_all.deb
Debian	13	all	mono	< 1.2.2.1-1	mono_1.2.2.1-1_all.deb