Description
Directory traversal vulnerability in the xsp component in mod_mono in Mono/C# web server, as used in SUSE Open-Enterprise-Server 1 and SUSE Linux 9.2 through 10.0, allows remote attackers to read arbitrary files via a .. (dot dot) sequence in an HTTP request.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | xsp | 1.1.15-1 | — |
References
- 21847 third-party-advisory
- ADV-2006-3552 vdb-entry
- 1016821 vdb-entry
- SUSE-SR:2006:022 vendor-advisory
- 19929 vdb-entry
- 21840 third-party-advisory