1. Forum
  2. Usenet
  3. LINUX.DEBIAN.ANNOUNCE.SEC

  • [SECURITY] [DSA 1691-1] New moodle packages fix several vulnerabilities

    From Thijs Kinkhorst@1:229/2 to All on Mon Dec 22 09:30:08 2008
    From: [email protected]

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    - ------------------------------------------------------------------------ Debian Security Advisory DSA-1691-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst December 22, 2008 http://www.debian.org/security/faq
    - ------------------------------------------------------------------------

    Package : moodle
    Vulnerability : several
    Problem type : remote
    Debian-specific: no
    CVE Id(s) : CVE-2007-3555 CVE-2008-1502 CVE-2008-3325 CVE-2008-3326
    CVE-2008-4796 CVE-2008-4810 CVE-2008-4811 CVE-2008-5432
    Debian Bugs : 432264 471158 489533 492492 504235 504345 508593

    Several remote vulnerabilities have been discovered in Moodle, an online
    course management system. The following issues are addressed in this
    update, ranging from cross site scripting to remote code execution.

    Various cross site scripting issues in the Moodle codebase
    (CVE-2008-3326, CVE-2008-3325, CVE-2007-3555, CVE-2008-5432,
    MSA-08-0021, MDL-8849, MDL-12793, MDL-11414, MDL-14806,
    MDL-10276).

    Various cross site request forgery issues in the Moodle codebase (CVE-2008-3325, MSA-08-0023).

    Privilege escalation bugs in the Moodle codebase (MSA-08-0001, MDL-7755).

    SQL injection issue in the hotpot module (MSA-08-0010).

    An embedded copy of Smarty had several vulnerabilities
    (CVE-2008-4811, CVE-2008-4810).
    An embedded copy of Snoopy was vulnerable to cross site scripting (CVE-2008-4796).
    An embedded copy of Kses was vulnerable to cross site scripting (CVE-2008-1502).

    For the stable distribution (etch), these problems have been fixed in
    version 1.6.3-2+etch1.

    For the unstable distribution (sid), these problems have been fixed in
    version 1.8.2.dfsg-2.

    We recommend that you upgrade your moodle (1.6.3-2+etch1) package.

    Upgrade instructions
    - --------------------

    wget url
    will fetch the file for you
    dpkg -i file.deb
    will install the referenced file.

    If you are using the apt-get package manager, use the line for
    sources.list as given below:

    apt-get update
    will update the internal database
    apt-get upgrade
    will install corrected packages

    You may use an automated update by adding the resources from the
    footer to the proper configuration.


    Debian GNU/Linux 4.0 alias etch
    - -------------------------------

    Source archives:

    http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+etch1.diff.gz
    Size/MD5 checksum: 24019 d29c179786ca1dcadf232c5e9a601362
    http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3.orig.tar.gz
    Size/MD5 checksum: 7465709 2f9f3fcf83ab0f18c409f3a48e07eae2
    http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+etch1.dsc
    Size/MD5 checksum: 793 d9a1fceaf316b608709be372d97e667a

    Architecture independent packages:

    http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+etch1_all.deb
    Size/MD5 checksum: 6592474 9a5fb5924faa639952c3171665bc347d


    These files will probably be moved into the stable distribution on
    its next update.

    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: [email protected]
    Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg> -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.6 (GNU/Linux)

    iQEVAwUBSU9O3Wz0hbPcukPfAQJEwwf9Hw1Rvt1FLIzzB4OsBKS91yaM+lqDwmfu pi7w5JXmc42AmaoVRCs23LxyqC30qV+vO3ZheYM7qgCZcrdpsWnYCOTy8Var6T0U hdeE7UeRdlaCMkMEHt505YxNMy7h0Z3HmhZB8ysuSTT9iQ2AAZMeUFJB1MUM/Yf2 8GiQcnIJMcaM8je0M7bjqzSYTA6H8EIuqZZk88FJHhWinMZLWGnKqUoG7cnFfOVd b0hKY093yf6hNT1pzx5a/a3PaKGjppGtZ+NnaBI8Q7YJvltqBb5lztWXFHuEJCWg 4Oo86NEb8/ARXGxugv0MUFvGPULfMVOTtnvF2BuTZLGZuvprofLy6Q==
    =kHvM
    -----END PGP SIGNATURE-----


    --
    To UNSUBSCRIBE, email to [email protected]
    with a subject of "unsubscribe". Trouble? Contact [email protected]

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)