CVE-2008-3906 CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the query str...
MediumCVSS 4.3
EPSS 7.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the query string.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mono | = 1.0 | No fix listed |
| mono | = 1.0.5 | No fix listed |
| mono | = 1.1.4 | No fix listed |
| mono | = 1.1.8.3 | No fix listed |
| mono | = 1.1.13 | No fix listed |
| mono | = 1.1.13.4 | No fix listed |
| mono | = 1.1.13.6 | No fix listed |
| mono | = 1.1.13.7 | No fix listed |
| mono | = 1.1.17 | No fix listed |
| mono | = 1.1.17.1 | No fix listed |
| mono | = 1.1.18 | No fix listed |
| mono | = 1.2.5.1 | No fix listed |
| mono project mono | <= 2.0 | No fix listed |
| mono project mono | = 1.2.1 | No fix listed |
| mono project mono | = 1.2.2 | No fix listed |
| mono project mono | = 1.2.3 | No fix listed |
| mono project mono | = 1.2.4 | No fix listed |
| mono project mono | = 1.2.5 | No fix listed |
| mono project mono | = 1.2.6 | No fix listed |
| mono project mono | = 1.9 | No fix listed |
| debian/mono(Debian:12) | < 1.9.1+dfsg-4 | 1.9.1+dfsg-4 |
| debian/mono(Debian:13) | < 1.9.1+dfsg-4 | 1.9.1+dfsg-4 |
| debian/mono(Debian:14) | < 1.9.1+dfsg-4 | 1.9.1+dfsg-4 |
References
- Debian Security Tracker CVE-2008-3906 vendor-advisory
- bugs.debian.org issue-tracking
- 31643 third-party-advisory vendor-advisory
- 36494 third-party-advisory
- wiki.rpath.com
- MDVSA-2008:210 vendor-advisory
- [oss-security] 20080827 CVE request: mono Sys.Web header injection mailing-list
- 20080930 rPSA-2008-0286-1 mono mailing-list
- 30867 exploit vdb-entry
- ADV-2008-2443 vdb-entry
- bugzilla.novell.com
- mono-sysweb-xss(44740) vdb-entry
- USN-826-1 vendor-advisory