Issues the date: 2008-08-20
Renewal date: 2008-08-29

Is affected the system:
Mono Mono 2.0
Description:
--------------------------------------------------------------------------------
BUGTRAQ ID: 30867

Mono is opens the source based on the .NET frame to develop the platform, the permission development personnel constructs Linux and the cross platform application.

The Mono Sys.Web module has not filtered certain parameters then to use correctly in the HTTP response, the long-distance aggressor may cause through the submission evil intention HTTP request to pour into willfully HTML and the script code and carries out in the user browser conversation.

<* origin: Juraj Skripsky (juraj@hotfeet.ch)
 
  Link: http://secunia.com/advisories/31643/
        https://bugzilla.novell.com/show_bug.cgi?format=multiple&id=418620
*>

Test method:
--------------------------------------------------------------------------------

Warning

The following procedure (method) possibly has the aggressivity, only supplies the safe research and teaching. The user risk is proud!

<script runat= " server " >
void Page_Load (object o, EventArgs e) {
    // Query parameter text is not checked before saving in user cookie
    NameValueCollection request = Request.QueryString;

    // Adding cookies to the response
    Response.Cookies [“userName”]. Value = request [“text”];
}
</script>

Suggested:
--------------------------------------------------------------------------------
Manufacturer patch:

Mono
----
At present the manufacturer had already issued the promotion patch repairs this security problem, welcome to manufacturer main page downloading:

http://www.mono-project.com/