阿里云漏洞库

当使用2.3.0.1之前的Moonlight或2.99.0.10之前的2.99.x时，Mono无法正确验证通用方法的参数，这使远程攻击者可以通过精心设计的方法调用绕过通用约束，并可能执行任意代码。

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： http://www.go-mono.com/moonlight/

参考链接
http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html
http://secunia.com/advisories/42373
http://secunia.com/advisories/42877
http://www.exploit-db.com/exploits/15974
http://www.mono-project.com/Vulnerabilities#Moonlight_Generic_Constraints_Byp...
http://www.securityfocus.com/bid/45051
http://www.vupen.com/english/advisories/2011/0076
https://bugzilla.novell.com/show_bug.cgi?id=654136
https://bugzilla.novell.com/show_bug.cgi?id=655847
https://github.com/mono/mono/commit/4905ef1130feb26c3150b28b97e4a96752e0d399
https://github.com/mono/mono/commit/65292a69c837b8a5f7a392d34db63de592153358
https://github.com/mono/mono/commit/cf1ec146f7c6acdc6697032b3aaafc68ffacdcac

CWE-ID	漏洞类型
CWE-20	输入验证不恰当