[ MDVSA-2008:210 ] mono
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2008:210
http://www.mandriva.com/security/
_______________________________________________________________________
Package : mono
Date : October 3, 2008
Affected: 2007.1, 2008.0, 2008.1
_______________________________________________________________________
Problem Description:
CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows
remote attackers to inject arbitrary HTTP headers and conduct HTTP
response splitting attacks via CRLF sequences in the query string.
The updated packages have been patched to fix the issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3906
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2007.1:
33213a75545728ba80dabc78854376aa 2007.1/i586/jay-1.2.3.1-4.2mdv2007.1.i586.rpm
2879f218520f88400db457f3696fa752
2007.1/i586/libmono0-1.2.3.1-4.2mdv2007.1.i586.rpm
da6ba149545134c7f551afd5a3822fce
2007.1/i586/libmono0-devel-1.2.3.1-4.2mdv2007.1.i586.rpm
7cc6408f71a5d1b78434fd688172bfab
2007.1/i586/mono-1.2.3.1-4.2mdv2007.1.i586.rpm
c6b9d4e73ee8a80efef6ab3722b39512
2007.1/i586/mono-bytefx-data-mysql-1.2.3.1-4.2mdv2007.1.i586.rpm
d7c43bee87f7eec42fb1d5a04b5f4b91
2007.1/i586/mono-data-1.2.3.1-4.2mdv2007.1.i586.rpm
02c86ffbd50722810e3fe0d52ef71f12
2007.1/i586/mono-data-firebird-1.2.3.1-4.2mdv2007.1.i586.rpm
fd99fa689b0bd8b5f182c438fb176ea8
2007.1/i586/mono-data-oracle-1.2.3.1-4.2mdv2007.1.i586.rpm
dc767934e9c968aa2c8c04dac55f028d
2007.1/i586/mono-data-postgresql-1.2.3.1-4.2mdv2007.1.i586.rpm
ec8bf1ec89443da0b08adcbc8b276eaf
2007.1/i586/mono-data-sqlite-1.2.3.1-4.2mdv2007.1.i586.rpm
2a24841df688f5d547e105c6e1789e7f
2007.1/i586/mono-data-sybase-1.2.3.1-4.2mdv2007.1.i586.rpm
c40e6ee882c2da9afa9a2497f9c7cc4f
2007.1/i586/mono-doc-1.2.3.1-4.2mdv2007.1.i586.rpm
5f9531eed6e615513d3f50f9b9b18fa6
2007.1/i586/mono-extras-1.2.3.1-4.2mdv2007.1.i586.rpm
7d54fa08d53d55b11a22b1950e100b4d
2007.1/i586/mono-ibm-data-db2-1.2.3.1-4.2mdv2007.1.i586.rpm
6191d7249a7e53719df10a62ee2feb29
2007.1/i586/mono-jscript-1.2.3.1-4.2mdv2007.1.i586.rpm
ce55d1111f656b8e5b2e6a985604104b
2007.1/i586/mono-locale-extras-1.2.3.1-4.2mdv2007.1.i586.rpm
230155cb67b8e86c29069fce862c21ce
2007.1/i586/mono-nunit-1.2.3.1-4.2mdv2007.1.i586.rpm
51e6a81000c3c1b912ed48fe0fd02d0b
2007.1/i586/mono-web-1.2.3.1-4.2mdv2007.1.i586.rpm
82e603977eeb1c1b4a0fe1f1fbb4b895
2007.1/i586/mono-winforms-1.2.3.1-4.2mdv2007.1.i586.rpm
44c5527b4696108d04a11dc21867140b
2007.1/SRPMS/mono-1.2.3.1-4.2mdv2007.1.src.rpm
Mandriva Linux 2007.1/X86_64:
61204f9f669c4ea0585f352b058211d1
2007.1/x86_64/jay-1.2.3.1-4.2mdv2007.1.x86_64.rpm
21ab48222f9a4c929e7344b2c869e351
2007.1/x86_64/lib64mono0-1.2.3.1-4.2mdv2007.1.x86_64.rpm
515be0e0ca293391af8f76655ea97446
2007.1/x86_64/lib64mono0-devel-1.2.3.1-4.2mdv2007.1.x86_64.rpm
cfa21e3aed6192000e19ff4523cca043
2007.1/x86_64/mono-1.2.3.1-4.2mdv2007.1.x86_64.rpm
f91dcc299003ce78dbbd3f9e9b7d86ed
2007.1/x86_64/mono-bytefx-data-mysql-1.2.3.1-4.2mdv2007.1.x86_64.rpm
72238f1d1a71022f8cb28f515ed4b640
2007.1/x86_64/mono-data-1.2.3.1-4.2mdv2007.1.x86_64.rpm
00078841edbd27e68c261745a34188b3
2007.1/x86_64/mono-data-firebird-1.2.3.1-4.2mdv2007.1.x86_64.rpm
523c29691a8a279bf0d7d4536d5a3abb
2007.1/x86_64/mono-data-oracle-1.2.3.1-4.2mdv2007.1.x86_64.rpm
9b6a658fc9b121a6ea1d437f83d2a850
2007.1/x86_64/mono-data-postgresql-1.2.3.1-4.2mdv2007.1.x86_64.rpm
0dfde2a38caf1d5c27b1b3a25b409f6b
2007.1/x86_64/mono-data-sqlite-1.2.3.1-4.2mdv2007.1.x86_64.rpm
90225a6ea8da883c0baae11ba9c6e78f
2007.1/x86_64/mono-data-sybase-1.2.3.1-4.2mdv2007.1.x86_64.rpm
bc71d8a12be676d91265cc7df7248ecd
2007.1/x86_64/mono-doc-1.2.3.1-4.2mdv2007.1.x86_64.rpm
b54455349e3445e00087526417254abf
2007.1/x86_64/mono-extras-1.2.3.1-4.2mdv2007.1.x86_64.rpm
d39cf678f1e9308519a1636f7ea92f1f
2007.1/x86_64/mono-ibm-data-db2-1.2.3.1-4.2mdv2007.1.x86_64.rpm
40a47b86f9147c4d29349c0e4f11c9cd
2007.1/x86_64/mono-jscript-1.2.3.1-4.2mdv2007.1.x86_64.rpm
d12d432fe87289ff96c09c2aad636b41
2007.1/x86_64/mono-locale-extras-1.2.3.1-4.2mdv2007.1.x86_64.rpm
a8d85b4b9459841b0e81745212f12c17
2007.1/x86_64/mono-nunit-1.2.3.1-4.2mdv2007.1.x86_64.rpm
3a6f55b9cc54633556ba587cab35c85c
2007.1/x86_64/mono-web-1.2.3.1-4.2mdv2007.1.x86_64.rpm
1f7a0a2e9820094dc620775734d5753a
2007.1/x86_64/mono-winforms-1.2.3.1-4.2mdv2007.1.x86_64.rpm
44c5527b4696108d04a11dc21867140b
2007.1/SRPMS/mono-1.2.3.1-4.2mdv2007.1.src.rpm
Mandriva Linux 2008.0:
e440db67f8ec5d285a7e302f67c54602 2008.0/i586/jay-1.2.5-4.2mdv2008.0.i586.rpm
0e6b2a56bf2afa7e7efe9d2b81a4b1e7
2008.0/i586/libmono0-1.2.5-4.2mdv2008.0.i586.rpm
2e3bedd273b74ef985f0664c3fe41091
2008.0/i586/libmono-devel-1.2.5-4.2mdv2008.0.i586.rpm
dc7843f9b8449c0284b710772a42b79d 2008.0/i586/mono-1.2.5-4.2mdv2008.0.i586.rpm
c61c9a71127ce59ed0c3258644a6c054
2008.0/i586/mono-bytefx-data-mysql-1.2.5-4.2mdv2008.0.i586.rpm
b7df0cbe0dd9d06493f560ed42e9c5c5
2008.0/i586/mono-data-1.2.5-4.2mdv2008.0.i586.rpm
92bf88ceb2f0682f8ab1c41aa9e29c48
2008.0/i586/mono-data-firebird-1.2.5-4.2mdv2008.0.i586.rpm
0f237a9773c57876762c4008c667f5ae
2008.0/i586/mono-data-oracle-1.2.5-4.2mdv2008.0.i586.rpm
e47ac96e6ff386dc0c9ea6813bcc8e86
2008.0/i586/mono-data-postgresql-1.2.5-4.2mdv2008.0.i586.rpm
b5e211ed04aa0fe9d42319e62cd5ec16
2008.0/i586/mono-data-sqlite-1.2.5-4.2mdv2008.0.i586.rpm
afee74831573c3a011fc75189000e40b
2008.0/i586/mono-data-sybase-1.2.5-4.2mdv2008.0.i586.rpm
8b9444c3357dbeaf9e01759bb540af13
2008.0/i586/mono-doc-1.2.5-4.2mdv2008.0.i586.rpm
2b13edcb7a0faf24eb476e040abdcf89
2008.0/i586/mono-extras-1.2.5-4.2mdv2008.0.i586.rpm
c9afd81fbd68b3af35d59e0029b05a18
2008.0/i586/mono-ibm-data-db2-1.2.5-4.2mdv2008.0.i586.rpm
844c2c859538f6097ffacc2185112aa7
2008.0/i586/mono-jscript-1.2.5-4.2mdv2008.0.i586.rpm
39b14d20448512d84853abd3816f2b00
2008.0/i586/mono-locale-extras-1.2.5-4.2mdv2008.0.i586.rpm
1db3fc6392a7027e4f906120eff6c5f4
2008.0/i586/mono-nunit-1.2.5-4.2mdv2008.0.i586.rpm
b9ab59d2f6d7bb88aec28cfd58f4a3e1
2008.0/i586/mono-web-1.2.5-4.2mdv2008.0.i586.rpm
c3ca573bd2df5045e158edeee7100ac1
2008.0/i586/mono-winforms-1.2.5-4.2mdv2008.0.i586.rpm
5774758e02d44a1e25954a282dcec114 2008.0/SRPMS/mono-1.2.5-4.2mdv2008.0.src.rpm
Mandriva Linux 2008.0/X86_64:
887d7492f9d184d321e2b50078a2960b
2008.0/x86_64/jay-1.2.5-4.2mdv2008.0.x86_64.rpm
fe81bf7e97b92e0e7df76e53a553d677
2008.0/x86_64/lib64mono0-1.2.5-4.2mdv2008.0.x86_64.rpm
db16848f3751a405c858b95252b2bf30
2008.0/x86_64/lib64mono-devel-1.2.5-4.2mdv2008.0.x86_64.rpm
820045515f0cda949c6c47728963f6e5
2008.0/x86_64/mono-1.2.5-4.2mdv2008.0.x86_64.rpm
e292ceaa2e468e15671796c226f7180a
2008.0/x86_64/mono-bytefx-data-mysql-1.2.5-4.2mdv2008.0.x86_64.rpm
ea7ba847015e1990a3bf4d2317084191
2008.0/x86_64/mono-data-1.2.5-4.2mdv2008.0.x86_64.rpm
9166aecd5a003a46b4b231f239d288fa
2008.0/x86_64/mono-data-firebird-1.2.5-4.2mdv2008.0.x86_64.rpm
b899d6863e2f26a66720f5044524ed3d
2008.0/x86_64/mono-data-oracle-1.2.5-4.2mdv2008.0.x86_64.rpm
8772d8ffa4f1f28f7c93d80dbe5ef295
2008.0/x86_64/mono-data-postgresql-1.2.5-4.2mdv2008.0.x86_64.rpm
4af23a4d43ea4ec9b2c1082775ead565
2008.0/x86_64/mono-data-sqlite-1.2.5-4.2mdv2008.0.x86_64.rpm
a294cd3e480c06bde1d3a89afae9dc46
2008.0/x86_64/mono-data-sybase-1.2.5-4.2mdv2008.0.x86_64.rpm
a43f6184f2cd50fab287d940bee99341
2008.0/x86_64/mono-doc-1.2.5-4.2mdv2008.0.x86_64.rpm
8df7250391e48bc12134dd92aaee3f2a
2008.0/x86_64/mono-extras-1.2.5-4.2mdv2008.0.x86_64.rpm
48f3c83b2cfd25354211ecf5080b3f52
2008.0/x86_64/mono-ibm-data-db2-1.2.5-4.2mdv2008.0.x86_64.rpm
f1d2bd1f6b7884474697203d011b7f41
2008.0/x86_64/mono-jscript-1.2.5-4.2mdv2008.0.x86_64.rpm
3696ebc448c50f9003cba99d82b352bc
2008.0/x86_64/mono-locale-extras-1.2.5-4.2mdv2008.0.x86_64.rpm
7b6f80e0648df7063a58a970d458d1af
2008.0/x86_64/mono-nunit-1.2.5-4.2mdv2008.0.x86_64.rpm
53ea6788122b45c2ecd03973424fde8b
2008.0/x86_64/mono-web-1.2.5-4.2mdv2008.0.x86_64.rpm
d57531d94f57264f635b4ece3d415798
2008.0/x86_64/mono-winforms-1.2.5-4.2mdv2008.0.x86_64.rpm
5774758e02d44a1e25954a282dcec114 2008.0/SRPMS/mono-1.2.5-4.2mdv2008.0.src.rpm
Mandriva Linux 2008.1:
c2a6a54629cda03a711b15d956ad48f1 2008.1/i586/jay-1.2.6-4.1mdv2008.1.i586.rpm
b2cdd14102b90342d3abc389ba3610b8
2008.1/i586/libmono0-1.2.6-4.1mdv2008.1.i586.rpm
45abeafb948f63b555399292ac1c155c
2008.1/i586/libmono-devel-1.2.6-4.1mdv2008.1.i586.rpm
5163daca32007961de96a4aed0ee3576 2008.1/i586/mono-1.2.6-4.1mdv2008.1.i586.rpm
b269506c27ed8b7a01ea6fd04aa68b2c
2008.1/i586/mono-bytefx-data-mysql-1.2.6-4.1mdv2008.1.i586.rpm
3763c1004ab62d125ae2e656e8e3bead
2008.1/i586/mono-data-1.2.6-4.1mdv2008.1.i586.rpm
706a44056e1498be81465db9d9ab1930
2008.1/i586/mono-data-firebird-1.2.6-4.1mdv2008.1.i586.rpm
3cea1df02c8ecf3a6318a91fd93a8df4
2008.1/i586/mono-data-oracle-1.2.6-4.1mdv2008.1.i586.rpm
752d16b45dc2a423a43b0c6e98262f5c
2008.1/i586/mono-data-postgresql-1.2.6-4.1mdv2008.1.i586.rpm
3f426b28984451a81be9bdbc16731c11
2008.1/i586/mono-data-sqlite-1.2.6-4.1mdv2008.1.i586.rpm
79a222d28afb85666b66b16656b6db01
2008.1/i586/mono-data-sybase-1.2.6-4.1mdv2008.1.i586.rpm
45eae87984a073a7b8dfa059857994c6
2008.1/i586/mono-doc-1.2.6-4.1mdv2008.1.i586.rpm
99ebd7c0ff7bae26c203444a3006b1ae
2008.1/i586/mono-extras-1.2.6-4.1mdv2008.1.i586.rpm
fc6467c8bf378553c1ce1212cdf862e6
2008.1/i586/mono-ibm-data-db2-1.2.6-4.1mdv2008.1.i586.rpm
7c5bd0f7060fb7e8584949be3b02e48e
2008.1/i586/mono-jscript-1.2.6-4.1mdv2008.1.i586.rpm
d8924d716ea0ca0b0d4cdbfd8716c8a7
2008.1/i586/mono-locale-extras-1.2.6-4.1mdv2008.1.i586.rpm
d9066626a5d602a21e0e83743cbba98f
2008.1/i586/mono-nunit-1.2.6-4.1mdv2008.1.i586.rpm
508f141816c872cbfb2ba33d2333c20d
2008.1/i586/mono-web-1.2.6-4.1mdv2008.1.i586.rpm
fe6afbabdedd6bed5b6787fd32e555cf
2008.1/i586/mono-winforms-1.2.6-4.1mdv2008.1.i586.rpm
ec2b756483755c770a038a89fa2b4558 2008.1/SRPMS/mono-1.2.6-4.1mdv2008.1.src.rpm
Mandriva Linux 2008.1/X86_64:
38159f51314a664bda8be4d5ac78c838
2008.1/x86_64/jay-1.2.6-4.1mdv2008.1.x86_64.rpm
3867b5b1c6b833aef4a3200025c11698
2008.1/x86_64/lib64mono0-1.2.6-4.1mdv2008.1.x86_64.rpm
9b34901a35a959f92c7ccf41dc622e7d
2008.1/x86_64/lib64mono-devel-1.2.6-4.1mdv2008.1.x86_64.rpm
f58d94a88270d64ab65518487ade64c1
2008.1/x86_64/mono-1.2.6-4.1mdv2008.1.x86_64.rpm
6c2b4395b61edf9e90947f8b31df174a
2008.1/x86_64/mono-bytefx-data-mysql-1.2.6-4.1mdv2008.1.x86_64.rpm
bc13ae1bf13544a69c6d4c65571fc6c1
2008.1/x86_64/mono-data-1.2.6-4.1mdv2008.1.x86_64.rpm
2ff830e90768927b2313fca1bd2e3867
2008.1/x86_64/mono-data-firebird-1.2.6-4.1mdv2008.1.x86_64.rpm
5670152b5beb3d7df66b992b6129cf78
2008.1/x86_64/mono-data-oracle-1.2.6-4.1mdv2008.1.x86_64.rpm
5d35833bc95cba9bc9e6612545f3d5ef
2008.1/x86_64/mono-data-postgresql-1.2.6-4.1mdv2008.1.x86_64.rpm
c928b1106a8549f390921be5586bb8d3
2008.1/x86_64/mono-data-sqlite-1.2.6-4.1mdv2008.1.x86_64.rpm
c73fe1acfe6bad1464ded4d0ec07d0ab
2008.1/x86_64/mono-data-sybase-1.2.6-4.1mdv2008.1.x86_64.rpm
71ede1c3f537727f9bed64bf907d505d
2008.1/x86_64/mono-doc-1.2.6-4.1mdv2008.1.x86_64.rpm
13bc42bb77fb01c5472f9346959a54fc
2008.1/x86_64/mono-extras-1.2.6-4.1mdv2008.1.x86_64.rpm
324d7824f09943da2782d8e9882556a2
2008.1/x86_64/mono-ibm-data-db2-1.2.6-4.1mdv2008.1.x86_64.rpm
178b5f1897be0b1a8345f6f789c5d114
2008.1/x86_64/mono-jscript-1.2.6-4.1mdv2008.1.x86_64.rpm
24bcfc417441e037bb3699c15f6138d0
2008.1/x86_64/mono-locale-extras-1.2.6-4.1mdv2008.1.x86_64.rpm
78856fb36cc4ba34f2f1a5866f4d8286
2008.1/x86_64/mono-nunit-1.2.6-4.1mdv2008.1.x86_64.rpm
a0565351873bddd9d211a98d1467f055
2008.1/x86_64/mono-web-1.2.6-4.1mdv2008.1.x86_64.rpm
00ae4d7f9547719004cd18269f656fa2
2008.1/x86_64/mono-winforms-1.2.6-4.1mdv2008.1.x86_64.rpm
ec2b756483755c770a038a89fa2b4558 2008.1/SRPMS/mono-1.2.6-4.1mdv2008.1.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFI5ohPmqjQ0CJFipgRAjYIAKCzXMe3gTau6/loKPvYMIe5OL93WACg7uz+
eS11qH2o6fIDbh/ulAFmrpg=
=McWr
-----END PGP SIGNATURE-----