Bug 853107 (CVE-2012-3543)

Summary:	CVE-2012-3543 mono: Hash collision issue
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	chkr, itamar, lxtnow, paul
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-10 10:59:14 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	853110, 853111
Bug Blocks:

Description Jan Lieskovsky 2012-08-30 14:26:17 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2011-3414 to the following vulnerability:

The CaseInsensitiveHashProvider.getHashCode function in the HashTable implementation in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka "Collisions in HashTable May Cause DoS Vulnerability."

It has been reported:
[1] http://www.openwall.com/lists/oss-security/2012/08/28/12

that the very same issue is present also in Mono .NET implementation too.
The CVE identifier of CVE-2012-3543 has been assigned:
[2] http://www.openwall.com/lists/oss-security/2012/08/28/14

to this flaw in Mono .NET implementation.

Mono upstream patches:
[3] https://github.com/mono/mono/commit/2ab1a051058fee5ea3aec2e071fba7000b693488
[4] https://github.com/mono/mono/commit/c3e088bf2fc22d66d0f17b74676de366f661c3eb

References:
[5] https://bugzilla.novell.com/show_bug.cgi?id=739119

Comment 1 Jan Lieskovsky 2012-08-30 14:28:13 UTC

This issue affects the versions of the mono package, as shipped with Fedora release of 16 and 17. Please schedule an update.

--

This issue affects the versions of the mono package, as shipped with Fedora EPEL 5 and Fedora EPEL 6. Please schedule an update.

Comment 2 Jan Lieskovsky 2012-08-30 14:29:12 UTC

Created mono tracking bugs for this issue

Affects: fedora-all [bug 853110]
Affects: epel-all [bug 853111]

Comment 3 leigh scott 2012-09-16 19:29:34 UTC

(In reply to comment #1)

> This issue affects the versions of the mono package, as shipped with Fedora
> EPEL 5 and Fedora EPEL 6. Please schedule an update.


I'm not going to fix this issue till upstream releases a proper patch for the 2.4.3 branch

https://github.com/mono/mono/tree/mono-2-4-3

Comment 4 Vincent Danen 2013-06-05 18:07:19 UTC

(In reply to leigh scott from comment #3)
> (In reply to comment #1)
> 
> > This issue affects the versions of the mono package, as shipped with Fedora
> > EPEL 5 and Fedora EPEL 6. Please schedule an update.
> 
> 
> I'm not going to fix this issue till upstream releases a proper patch for
> the 2.4.3 branch
> 
> https://github.com/mono/mono/tree/mono-2-4-3

This will never happen.  Mono 2.x is EOL upstream, so this upstream fix seems to only in the 3.x branch but none of the release notes mention it.

Comment 5 Product Security DevOps Team 2019-06-10 10:59:14 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.