Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title moodle security update
Informations
Name DSA-2172 First vendor Publication 2011-02-22
Vendor Debian Last vendor Modification 2011-02-22
Severity (Vendor) N/A Revision 1

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:P/A:P)
Cvss Base Score 6.4 Attack Range Network
Cvss Impact Score 4.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Several vulnerabilties have been discovered in phpCAS, a CAS client library for PHP. The Moodle course management system includes a copy of phpCAS.

For the oldstable distribution (lenny), this problem has been fixed in version 1.8.13-3.

The stable distribution (squeeze) already contains a fixed version of phpCAS.

The unstable distribution (sid) already contains a fixed version of phpCAS.

We recommend that you upgrade your moodle packages.

Original Source

Url : http://www.debian.org/security/2011/dsa-2172

CWE : Common Weakness Enumeration

% Id Name
40 % CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)
20 % CWE-59 Improper Link Resolution Before File Access ('Link Following')
20 % CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE/SANS Top 25)
20 % CWE-20 Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:12588
 
Oval ID: oval:org.mitre.oval:def:12588
Title: DSA-2172-1 moodle -- several
Description: Several vulnerabilties have been discovered in phpCAS, a CAS client library for PHP. The Moodle course management system includes a copy of phpCAS.
Family: unix Class: patch
Reference(s): DSA-2172-1
CVE-2010-2795
CVE-2010-2796
CVE-2010-3690
CVE-2010-3691
CVE-2010-3692
 Version: 5
Platform(s): Debian GNU/Linux 5.0
 Product(s): moodle
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 30
Application 34

OpenVAS Exploits

Date Description
2011-03-09 Name : Debian Security Advisory DSA 2172-1 (moodle)
File : nvt/deb_2172_1.nasl
2010-12-02 Name : Fedora Update for php-pear-CAS FEDORA-2010-12320
File : nvt/gb_fedora_2010_12320_php-pear-CAS_fc14.nasl
2010-12-02 Name : Fedora Update for moodle FEDORA-2010-13396
File : nvt/gb_fedora_2010_13396_moodle_fc14.nasl
2010-12-02 Name : Fedora Update for php-pear-CAS FEDORA-2010-15796
File : nvt/gb_fedora_2010_15796_php-pear-CAS_fc14.nasl
2010-11-16 Name : Fedora Update for glpi FEDORA-2010-16905
File : nvt/gb_fedora_2010_16905_glpi_fc12.nasl
2010-11-16 Name : Fedora Update for glpi FEDORA-2010-16912
File : nvt/gb_fedora_2010_16912_glpi_fc13.nasl
2010-10-22 Name : Fedora Update for php-pear-CAS FEDORA-2010-15943
File : nvt/gb_fedora_2010_15943_php-pear-CAS_fc13.nasl
2010-10-22 Name : Fedora Update for php-pear-CAS FEDORA-2010-15970
File : nvt/gb_fedora_2010_15970_php-pear-CAS_fc12.nasl
2010-09-07 Name : Fedora Update for php-pear-CAS FEDORA-2010-12247
File : nvt/gb_fedora_2010_12247_php-pear-CAS_fc12.nasl
2010-09-07 Name : Fedora Update for php-pear-CAS FEDORA-2010-12258
File : nvt/gb_fedora_2010_12258_php-pear-CAS_fc13.nasl
2010-08-24 Name : Fedora Update for moodle FEDORA-2010-13250
File : nvt/gb_fedora_2010_13250_moodle_fc13.nasl
2010-08-24 Name : Fedora Update for moodle FEDORA-2010-13254
File : nvt/gb_fedora_2010_13254_moodle_fc12.nasl
2010-08-19 Name : phpCAS Session Hijacking and Cross-Site Scripting Vulnerabilities
File : nvt/gb_phpcas_session_hijack_n_xss_vuln.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
68523 phpCAS Unspecified Function getURL Call XSS
68522 phpCAS Unspecified Function getCallbackURL Call XSS
68521 phpCAS client.php Callback Function PGTiou Parameter XSS
68520 phpCAS PGTStorage/pgt-file.php Symlink Arbitrary File Overwrite
68519 phpCAS client.php Callback Function PGTiou Parameter Traversal Arbitrary File...
66892 phpCAS Proxy Mode Callback URL XSS
66891 phpCAS Crafted Ticket Value Query String Session Hijack

Nessus® Vulnerability Scanner

Date Description
2011-02-23 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2172.nasl - Type : ACT_GATHER_INFO
2010-11-07 Name : The remote Fedora host is missing a security update.
File : fedora_2010-16905.nasl - Type : ACT_GATHER_INFO
2010-11-07 Name : The remote Fedora host is missing a security update.
File : fedora_2010-16912.nasl - Type : ACT_GATHER_INFO
2010-10-20 Name : The remote Fedora host is missing a security update.
File : fedora_2010-15943.nasl - Type : ACT_GATHER_INFO
2010-10-20 Name : The remote Fedora host is missing a security update.
File : fedora_2010-15970.nasl - Type : ACT_GATHER_INFO
2010-10-15 Name : The remote Fedora host is missing a security update.
File : fedora_2010-15796.nasl - Type : ACT_GATHER_INFO
2010-09-02 Name : The remote Fedora host is missing a security update.
File : fedora_2010-12320.nasl - Type : ACT_GATHER_INFO
2010-08-31 Name : The remote Fedora host is missing a security update.
File : fedora_2010-12247.nasl - Type : ACT_GATHER_INFO
2010-08-31 Name : The remote Fedora host is missing a security update.
File : fedora_2010-12258.nasl - Type : ACT_GATHER_INFO
2010-08-24 Name : The remote Fedora host is missing a security update.
File : fedora_2010-13396.nasl - Type : ACT_GATHER_INFO
2010-08-23 Name : The remote Fedora host is missing a security update.
File : fedora_2010-13250.nasl - Type : ACT_GATHER_INFO
2010-08-23 Name : The remote Fedora host is missing a security update.
File : fedora_2010-13254.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:29:54
  • Multiple Updates