PT-2006-7586 · Suse+1 · Suse Linux Enterprise+18

Sebastian Krahmer · Published 1970-01-01 · Updated 2017-07-20 · CVE-2006-5072

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions mono (affected versions not specified) mono-core (affected versions not specified) mono-core-32bit (affected versions not specified) mono-core-x86 (affected versions not specified) mono-data (affected versions not specified) mono-data-sqlite (affected versions not specified) mono-data-sybase (affected versions not specified) mono-devel (affected versions not specified) mono-extras (affected versions not specified) mono-ikvm (affected versions not specified) mono-jscript (affected versions not specified) mono-locale-extras (affected versions not specified) mono-nunit (affected versions not specified) mono-web (affected versions not specified) mono-winforms (affected versions not specified) bytefx-data-mysql (affected versions not specified) mono-basic (affected versions not specified)

Description The issue affects multiple packages of the mono operating system, including SUSE Linux Enterprise and openSUSE, allowing for remote exploitation. This can lead to a breach of confidentiality, integrity, and availability of protected information. The System.CodeDom.Compiler classes in Novell Mono create temporary files with insecure permissions, enabling local users to overwrite arbitrary files or execute arbitrary code via a symlink attack.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

BDU:2015-04635

BDU:2015-04636

BDU:2015-04637

BDU:2015-04638

BDU:2015-04639

BDU:2015-04640

BDU:2015-04641

BDU:2015-04642

BDU:2015-04643

BDU:2015-04644

BDU:2015-04645

BDU:2015-04646

BDU:2015-04647

BDU:2015-04648

BDU:2015-04649

BDU:2015-04650

BDU:2015-04651

BDU:2015-04925

BDU:2015-04926

CVE-2006-5072

Affected Products

Suse Linux Enterprise

Bytefx-Data-Mysql

Mono

Mono-Basic

Mono-Core

Mono-Core-32Bit

Mono-Core-X86

Mono-Data

Mono-Data-Sqlite

Mono-Data-Sybase

Mono-Devel

Mono-Extras

Mono-Ikvm

Mono-Jscript

Mono-Locale-Extras

Mono-Nunit

Mono-Web

Mono-Winforms

Opensuse

References · 39

• https://bdu.fstec.ru/vul/2015-04648 · Security Note
• http://security.gentoo.org/glsa/glsa-200611-23.xml · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04638 · Security Note
• https://bdu.fstec.ru/vul/2015-04647 · Security Note
• http://fedoranews.org/cms/node/2401 · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_73_mono.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-5072 · Security Note
• http://secunia.com/advisories/22237 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04637 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2006:188 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04639 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-5072 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04649 · Security Note
• http://secunia.com/advisories/22277 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04646 · Security Note