This service will be undergoing maintenance at 00:00 UTC, 2016-08-01. It is expected to last about 1 hours
Bug 853107 - (CVE-2012-3543) CVE-2012-3543 mono: Hash collision issue
CVE-2012-3543 mono: Hash collision issue
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20120724,repor...
: Security
Depends On: 853110 853111
Blocks:
  Show dependency treegraph
 
Reported: 2012-08-30 10:26 EDT by Jan Lieskovsky
Modified: 2015-07-31 02:53 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2012-08-30 10:26:17 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2011-3414 to the following vulnerability:

The CaseInsensitiveHashProvider.getHashCode function in the HashTable implementation in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka "Collisions in HashTable May Cause DoS Vulnerability."

It has been reported:
[1] http://www.openwall.com/lists/oss-security/2012/08/28/12

that the very same issue is present also in Mono .NET implementation too.
The CVE identifier of CVE-2012-3543 has been assigned:
[2] http://www.openwall.com/lists/oss-security/2012/08/28/14

to this flaw in Mono .NET implementation.

Mono upstream patches:
[3] https://github.com/mono/mono/commit/2ab1a051058fee5ea3aec2e071fba7000b693488
[4] https://github.com/mono/mono/commit/c3e088bf2fc22d66d0f17b74676de366f661c3eb

References:
[5] https://bugzilla.novell.com/show_bug.cgi?id=739119
Comment 1 Jan Lieskovsky 2012-08-30 10:28:13 EDT
This issue affects the versions of the mono package, as shipped with Fedora release of 16 and 17. Please schedule an update.

--

This issue affects the versions of the mono package, as shipped with Fedora EPEL 5 and Fedora EPEL 6. Please schedule an update.
Comment 2 Jan Lieskovsky 2012-08-30 10:29:12 EDT
Created mono tracking bugs for this issue

Affects: fedora-all [bug 853110]
Affects: epel-all [bug 853111]
Comment 3 leigh scott 2012-09-16 15:29:34 EDT
(In reply to comment #1)

> This issue affects the versions of the mono package, as shipped with Fedora
> EPEL 5 and Fedora EPEL 6. Please schedule an update.


I'm not going to fix this issue till upstream releases a proper patch for the 2.4.3 branch

https://github.com/mono/mono/tree/mono-2-4-3
Comment 4 Vincent Danen 2013-06-05 14:07:19 EDT
(In reply to leigh scott from comment #3)
> (In reply to comment #1)
> 
> > This issue affects the versions of the mono package, as shipped with Fedora
> > EPEL 5 and Fedora EPEL 6. Please schedule an update.
> 
> 
> I'm not going to fix this issue till upstream releases a proper patch for
> the 2.4.3 branch
> 
> https://github.com/mono/mono/tree/mono-2-4-3

This will never happen.  Mono 2.x is EOL upstream, so this upstream fix seems to only in the 3.x branch but none of the release notes mention it.

Note You need to log in before you can comment on or make changes to this bug.