Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2012.0232
moodle security update
1 March 2012
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: moodle
Publisher: Debian
Operating System: Debian GNU/Linux 6
UNIX variants (UNIX, Linux, OSX)
Windows
Impact/Access: Access Confidential Data -- Remote/Unauthenticated
Unauthorised Access -- Remote/Unauthenticated
Access Privileged Data -- Remote/Unauthenticated
Provide Misleading Information -- Remote/Unauthenticated
Reduced Security -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2012-0796 CVE-2012-0795 CVE-2012-0794
CVE-2012-0793 CVE-2012-0792 CVE-2011-4588
CVE-2011-4587 CVE-2011-4586 CVE-2011-4585
CVE-2011-4584 CVE-2011-4308
Original Bulletin:
http://www.debian.org/security/2012/dsa-2421
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-2421-1 security@debian.org
http://www.debian.org/security/ Moritz Muehlenhoff
February 29, 2012 http://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : moodle
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE ID : CVE-2011-4308 CVE-2011-4584 CVE-2011-4585 CVE-2011-4586
CVE-2011-4587 CVE-2011-4588 CVE-2012-0792 CVE-2012-0793
CVE-2012-0794 CVE-2012-0795 CVE-2012-0796
Several security issues have been fixed in Moodle, a course management
system for online learning:
CVE-2011-4308 / CVE-2012-0792
Rossiani Wijaya discovered an information leak in
mod/forum/user.php
CVE-2011-4584
MNET authentication didn't prevent a user using "Login As" from
jumping to a remove MNET SSO.
CVE-2011-4585
Darragh Enright discovered that the change password form was send in
over plain HTTP even if httpslogin was set to "true".
CVE-2011-4586
David Michael Evans and German Sanchez Gances discovered CRLF
injection/HTTP response splitting vulnerabilities in the Calendar
module.
CVE-2011-4587
Stephen Mc Guiness discovered empty passwords could be entered in
some circumstances.
CVE-2011-4588
Patrick McNeill that IP address restrictions could be bypassed in
MNET.
CVE-2012-0796
Simon Coggins discovered that additional information could be
injected into mail headers.
CVE-2012-0795
John Ehringer discovered that email adresses were insufficiently
validated.
CVE-2012-0794
Rajesh Taneja discovered that cookie encryption used a fixed key.
CVE-2012-0793
Eloy Lafuente discovered that profile images were insufficiently
protected. A new configuration option "forceloginforprofileimages"
was introduced for that.
For the stable distribution (squeeze), this problem has been fixed in
version 1.9.9.dfsg2-2.1+squeeze3.
For the unstable distribution (sid), this problem has been fixed in
version 1.9.9.dfsg2-5.
We recommend that you upgrade your moodle packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iEYEARECAAYFAk9OiDwACgkQXm3vHE4uylo/hgCeJ3spjXWQ6u8IFGD46zvojo9q
uxwAn2rERp2dJLBEJBEE7ak0bJtONxjZ
=YNgS
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBT07NIe4yVqjM2NGpAQKGQhAApEjNZo/+5O4TSDLw+kzWre5F9daJu3Z1
IlSUu8DYdzw+83RXmUKqYvJ1nqqH+TjQ6qzlIEbYa67iCzeGHWBlwWhT06/8AUfL
lr9OFl/e6zZqfK64iRNk17MS0+dZvVBlqwBLHTbwdTKqy4wQn0lHDV4+snLyNw4W
G+6dgwdl4uSy0ko/oHplwcha84mWl2/qB6wcN1hfwXalCgU2+nX7aXl9CcFcONtF
2xuBz4SgzNpoPrInealmAttlqdbGc1EEQqqRSzvHCS4ZEMDRU/zbmxQXb+Zuo3Rf
QtyPKoJgSRqwqD+9wAugWwP7tIz4jduMkrTc3nHME3LDRoSo0ACKQyj9xejQM0Z9
EX/+izUAbn78abKeIBBzY0MCDBiofwZwpGEaOQfEKf/3CrIpHFELxhWujjywZD/r
OTydfdd8rbGLq3ZJfQcAyCv12qrUPlLeO+VP/6aBnElPOhP200oZBB07aluHDPYN
9fcKD7po57OMgHJGwZfHA1Y6yrYkq+tvyFyg8Du+BzTu7no6BPMwAjeZQtQ/g4Mc
A2Cf4F11FJYEUKxMcikj6X2I3p97YzFSIHtB/twBSmd1MhPBrY4gL30by18diopb
P9NG9W7d3kXPR1tQoaIO4U5X7O6DYuOKIPpqYEHI0FNUARY8wl43j8zQyYfitqK6
RWEuvli5F1M=
=5Gwa
-----END PGP SIGNATURE-----