Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | New moodle packages fix several vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | DSA-1724 | First vendor Publication | 2009-02-13 |
| Vendor | Debian | Last vendor Modification | 2009-02-13 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 6.9 | Attack Range | Local |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 3.4 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Several vulnerabilities have been discovered in Moodle, an online course management system. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-0500 It was discovered that the information stored in the log tables was not properly sanitized, which could allow attackers to inject arbitrary web code. CVE-2009-0502 It was discovered that certain input via the "Login as" function was not properly sanitised leading to the injection of arbitrary web script. CVE-2008-5153 Dmitry E. Oboukhov discovered that the SpellCheker plugin creates temporary files insecurely, allowing a denial of service attack. Since the plugin was unused, it is removed in this update. For the stable distribution (etch) these problems have been fixed in version 1.6.3-2+etch2. For the testing (lenny) distribution these problems have been fixed in version 1.8.2.dfsg-3+lenny1. For the unstable (sid) distribution these problems have been fixed in version 1.8.2.dfsg-4. We recommend that you upgrade your moodle package. |
Original Source
| Url : http://www.debian.org/security/2009/dsa-1724 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 67 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
| 33 % | CWE-59 | Improper Link Resolution Before File Access ('Link Following') |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:13572 | |||
| Oval ID: | oval:org.mitre.oval:def:13572 | ||
| Title: | DSA-1724-1 moodle -- several vulnerabilities | ||
| Description: | Several vulnerabilities have been discovered in Moodle, an online course management system. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-0500 It was discovered that the information stored in the log tables was not properly sanitised, which could allow attackers to inject arbitrary web code. CVE-2009-0502 It was discovered that certain input via the "Login as" function was not properly sanitised leading to the injection of arbitrary web script. CVE-2008-5153 Dmitry E. Oboukhov discovered that the SpellCheker plugin creates temporary files insecurely, allowing a denial of service attack. Since the plugin was unused, it is removed in this update. For the stable distribution these problems have been fixed in version 1.6.3-2+etch2. For the testing distribution these problems have been fixed in version 1.8.2.dfsg-3+lenny1. For the unstable distribution these problems have been fixed in version 1.8.2.dfsg-4. We recommend that you upgrade your moodle package. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1724-1 CVE-2009-0500 CVE-2009-0502 CVE-2008-5153 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | moodle |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:8102 | |||
| Oval ID: | oval:org.mitre.oval:def:8102 | ||
| Title: | DSA-1724 moodle -- several vulnerabilities | ||
| Description: | Several vulnerabilities have been discovered in Moodle, an online course management system. The Common Vulnerabilities and Exposures project identifies the following problems: It was discovered that the information stored in the log tables was not properly sanitised, which could allow attackers to inject arbitrary web code. It was discovered that certain input via the "Login as" function was not properly sanitised leading to the injection of arbitrary web script. Dmitry E. Oboukhov discovered that the SpellCheker plugin creates temporary files insecurely, allowing a denial of service attack. Since the plugin was unused, it is removed in this update. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1724 CVE-2009-0500 CVE-2009-0502 CVE-2008-5153 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | moodle |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-12-14 | Name : Fedora Core 10 FEDORA-2009-13040 (moodle) File : nvt/fcore_2009_13040.nasl |
| 2009-06-30 | Name : Ubuntu USN-791-1 (moodle) File : nvt/ubuntu_791_1.nasl |
| 2009-04-06 | Name : Fedora Core 10 FEDORA-2009-3280 (moodle) File : nvt/fcore_2009_3280.nasl |
| 2009-04-06 | Name : Fedora Core 9 FEDORA-2009-3283 (moodle) File : nvt/fcore_2009_3283.nasl |
| 2009-03-31 | Name : SuSE Security Summary SUSE-SR:2009:007 File : nvt/suse_sr_2009_007.nasl |
| 2009-03-03 | Name : Moodle CMS Multiple Vulnerabilities File : nvt/gb_moodle_cms_mult_vuln.nasl |
| 2009-02-18 | Name : Debian Security Advisory DSA 1724-1 (moodle) File : nvt/deb_1724_1.nasl |
| 2009-02-18 | Name : Fedora Core 10 FEDORA-2009-1699 (moodle) File : nvt/fcore_2009_1699.nasl |
| 2009-02-13 | Name : Fedora Core 9 FEDORA-2009-1641 (moodle) File : nvt/fcore_2009_1641.nasl |
| 2009-01-26 | Name : Fedora Core 9 FEDORA-2009-0814 (moodle) File : nvt/fcore_2009_0814.nasl |
| 2009-01-26 | Name : Fedora Core 10 FEDORA-2009-0819 (moodle) File : nvt/fcore_2009_0819.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 54088 | Moodle w/ Snoopy blocks/html/block_html.php HTML Block XSS |
| 54086 | Moodle course/lib.php Log Table Information XSS |
| 49987 | Moodle spell-check-logic.cgi Multiple Temporary File Symlink Arbitrary File O... Moodle contains a flaw that may allow a malicious local user to overwrite arbitrary files on the system. The issue is due to the spell-check-logic.cgi script creating temporary files insecurely. It is possible for a user to use a symlink style attack to manipulate arbitrary files, resulting in a loss of integrity. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_moodle-090320.nasl - Type : ACT_GATHER_INFO |
| 2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_moodle-090319.nasl - Type : ACT_GATHER_INFO |
| 2009-06-25 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-791-1.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Fedora host is missing a security update. File : fedora_2009-0819.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Fedora host is missing a security update. File : fedora_2009-1699.nasl - Type : ACT_GATHER_INFO |
| 2009-03-24 | Name : The remote openSUSE host is missing a security update. File : suse_moodle-6108.nasl - Type : ACT_GATHER_INFO |
| 2009-02-17 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1724.nasl - Type : ACT_GATHER_INFO |
| 2009-02-13 | Name : The remote Fedora host is missing a security update. File : fedora_2009-1641.nasl - Type : ACT_GATHER_INFO |
| 2009-01-22 | Name : The remote Fedora host is missing a security update. File : fedora_2009-0814.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:28:12 |
|
