[Mono-dev] Security Issue
bperry.volatile at gmail.com
Fri Feb 28 18:49:47 UTC 2014
Does this work against xsp running independently from apache or does it require mod_mono? Currently testing against xsp4 126.96.36.199 and they web server does not crash.
Obviously this is relatively old.
Sent from a computer
> On Feb 28, 2014, at 9:22 AM, Greg Young <gregoryyoung1 at gmail.com> wrote:
> After some reproduction work we found it was an API difference in mono httplistener vs .net http listener that caused us to mangle something.
> In particular on a post with no content-length mono throws a disposed exception on accessing context where as .net does not.
> To reproduce use:
> curl -v http://server.com/ -X POST
>> On Fri, Feb 28, 2014 at 3:48 PM, Sebastien Pouliot <sebastien.pouliot at gmail.com> wrote:
>> Hello Greg,
>> Use the contact form found at
>>> On Fri, Feb 28, 2014 at 8:40 AM, Greg Young <gregoryyoung1 at gmail.com> wrote:
>>> I believe I have what should be a top rated security vulnerability that probably should not be discussed on this list as it allows anyone to take down a mono back end with a poisoned packet. Who should I talk to about this?
>>> Le doute n'est pas une condition agréable, mais la certitude est absurde.
>>> Mono-devel-list mailing list
>>> Mono-devel-list at lists.ximian.com
> Le doute n'est pas une condition agréable, mais la certitude est absurde.
> Mono-devel-list mailing list
> Mono-devel-list at lists.ximian.com
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Mono-devel-list