Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | New mahara packages fix several vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | DSA-2067 | First vendor Publication | 2010-07-02 |
| Vendor | Debian | Last vendor Modification | 2010-07-02 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Several vulnerabilities were discovered in mahara, an electronic portfolio, weblog, and resume builder. The following Common Vulnerabilities and Exposures project ids identify them: CVE-2010-1667 Multiple pages performed insufficient input sanitising, making them vulnerable to cross-site scripting attacks. CVE-2010-1668 Multiple forms lacked protection against cross-site request forgery attacks, therefore making them vulnerable. CVE-2010-1670 Gregor Anzelj discovered that it was possible to accidentally configure an installation of mahara that allows access to another user's account without a password. CVE-2010-2479 Certain Internet Explorer-specific cross-site scripting vulnerabilities were discovered in HTML Purifier, of which a copy is included in the mahara package. For the stable distribution (lenny), the problems have been fixed in version 1.0.4-4+lenny6. For the testing distribution (squeeze), the problems will be fixed soon. For the unstable distribution (sid), the problems have been fixed in version 1.2.5. We recommend that you upgrade your mahara packages. |
Original Source
| Url : http://www.debian.org/security/2010/dsa-2067 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 50 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
| 25 % | CWE-352 | Cross-Site Request Forgery (CSRF) (CWE/SANS Top 25) |
| 25 % | CWE-287 | Improper Authentication |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:11886 | |||
| Oval ID: | oval:org.mitre.oval:def:11886 | ||
| Title: | DSA-2067 mahara -- several vulnerabilities | ||
| Description: | Several vulnerabilities were discovered in mahara, an electronic portfolio, weblog, and resume builder. The following Common Vulnerabilities and Exposures project ids identify them: Multiple pages performed insufficient input sanitising, making them vulnerable to cross-site scripting attacks. Multiple forms lacked protection against cross-site request forgery attacks, therefore making them vulnerable. Gregor Anzelj discovered that it was possible to accidentally configure an installation of mahara that allows access to another user's account without a password. Certain Internet Explorer-specific cross-site scripting vulnerabilities were discovered in HTML Purifier, of which a copy is included in the mahara package. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2067 CVE-2010-1667 CVE-2010-1668 CVE-2010-1670 CVE-2010-2479 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 | Product(s): | mahara |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:13104 | |||
| Oval ID: | oval:org.mitre.oval:def:13104 | ||
| Title: | DSA-2067-1 mahara -- several | ||
| Description: | Several vulnerabilities were discovered in mahara, an electronic portfolio, weblog, and resume builder. The following Common Vulnerabilities and Exposures project ids identify them: CVE-2010-1667 Multiple pages performed insufficient input sanitising, making them vulnerable to cross-site scripting attacks. CVE-2010-1668 Multiple forms lacked protection against cross-site request forgery attacks, therefore making them vulnerable. CVE-2010-1670 Gregor Anzelj discovered that it was possible to accidentally configure an installation of mahara that allows access to another user's account without a password. CVE-2010-2479 Certain Internet Explorer-specific cross-site scripting vulnerabilities were discovered in HTML Purifier, of which a copy is included in the mahara package. For the stable distribution, the problems have been fixed in version 1.0.4-4+lenny6. For the testing distribution, the problems will be fixed soon. For the unstable distribution, the problems have been fixed in version 1.2.5. We recommend that you upgrade your mahara packages. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2067-1 CVE-2010-1667 CVE-2010-1668 CVE-2010-1670 CVE-2010-2479 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 | Product(s): | mahara |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2010-12-02 | Name : Fedora Update for moodle FEDORA-2010-13396 File : nvt/gb_fedora_2010_13396_moodle_fc14.nasl |
| 2010-08-24 | Name : Fedora Update for moodle FEDORA-2010-13250 File : nvt/gb_fedora_2010_13250_moodle_fc13.nasl |
| 2010-08-24 | Name : Fedora Update for moodle FEDORA-2010-13254 File : nvt/gb_fedora_2010_13254_moodle_fc12.nasl |
| 2010-07-05 | Name : Mahara Multiple Remote Vulnerabilities File : nvt/gb_mahara_41319.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 66062 | Mahara Single Sign-on Authentication Plugin Null Password Authentication Bypass |
| 66060 | Mahara Multiple Unspecified CSRF |
| 66059 | Mahara Multiple Unspecified XSS |
| 64113 | HTML Purifier Unspecified XSS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2010-08-24 | Name : The remote Fedora host is missing a security update. File : fedora_2010-13396.nasl - Type : ACT_GATHER_INFO |
| 2010-08-23 | Name : The remote Fedora host is missing a security update. File : fedora_2010-13250.nasl - Type : ACT_GATHER_INFO |
| 2010-08-23 | Name : The remote Fedora host is missing a security update. File : fedora_2010-13254.nasl - Type : ACT_GATHER_INFO |
| 2010-07-05 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2067.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:29:30 |
|
