Bug 461752 (CVE-2008-3906)

Summary:	CVE-2008-3906 mono: Sys.Web HTTP header injection attack
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED RAWHIDE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	lxtnow, paul
Target Milestone:	---	Keywords:	Reopened, Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-12-23 22:37:17 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	461753, 461754, 461755
Bug Blocks:

Description Tomas Hoger 2008-09-10 12:45:31 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2008-3906 to the
following vulnerability:

CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the query string.

References:
https://bugzilla.novell.com/show_bug.cgi?id=418620
http://www.openwall.com/lists/oss-security/2008/08/27/6
http://secunia.com/advisories/31643
http://www.securityfocus.com/bid/30867
http://www.frsirt.com/english/advisories/2008/2443

Upstream commits to various SVN branches are mentioned in Novell bugzilla:
https://bugzilla.novell.com/show_bug.cgi?id=418620#c12
https://bugzilla.novell.com/show_bug.cgi?id=418620#c16

Comment 2 Paul F. Johnson 2008-09-18 22:29:56 UTC

Fixed in the next push (should hit rawhide tomorrow/saturday)

Comment 3 Tomas Hoger 2008-09-29 13:23:19 UTC

Re-opening this parent bugs, which is supposed to track this issue across all supported versions, as F8/F9 should still be unfixed.