oss-security - CVE-2009-0689 discovered in Mono prior to 4.2

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <5675CFDD.9050309@apebox.org>
Date: Sat, 19 Dec 2015 21:45:01 +0000
From: Jo Shields <directhex@...box.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2009-0689 discovered in Mono prior to 4.2

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Dear all,

Security researchers at NCC Group have discovered that CVE-2009-0689, a
definite DOS (and possible arbitrary code execution) in various
applications' string-to-double parser implementations, also applies to
Mono versions prior to 4.2.

A fix is available
at https://gist.github.com/directhex/01e853567fd2cc74ed39 and should
apply cleanly to all versions of Mono you might care about.

This fix should be applied to all Mono packages prior to 4.2 (everything
except Debian Unstable, Ubuntu 16.04, and Arch, from a quick look)

Attached is the disclosure as-received by us, which includes a minimal
test case to demonstrate the vulnerability.

Thanks to Peter McLarnan <Peter.McLarnan@...group.trust> and Andy
Schmitz <andy.schmitz@...group.trust>

Apologies for the lateness in sending this, I sent it to the wrong
list & didn't notice until pointed out to me recently.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJWdc/dAAoJEMkPnLkOH60MQ3kH/3hNr7Fx/XOc+ql1UJ9LwEP0
+oPLCTPOEfG6b448oISDvVhxJaKkCpmMSKHjrcY80ig+dKm7qLp9o3sWRSzBmjA/
lXVIiHeU11KTsAlgMamNminL+kqNm8H7FlEAoqJIudb2pzkfUrEwLya3+rSnZe54
FBt0uGuHx3eF7ms8BTo3vEtQlhMsiYJh78sKCGNUSqLZ5ObGqLXoKiZq/J1JtZ/w
G5kRRD2GpyoIMsaneejBzqH7XF1GTvbSlEiWRScslRAXpj9y59ssHDDHi4FhIrSS
vPn0s+biTS3bsH9/H33uwcDPh65UaNha+J+opKZd5MMUqtoBERs6vHyGpaCNNPI=
=uXMH
-----END PGP SIGNATURE-----

View attachment "mono_disclosure.txt" of type "text/plain" (3136 bytes)

Download attachment "mono_disclosure.txt.sig" of type "application/pgp-signature" (287 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.