----------------------------------------------------------------------

Ovum says ad hoc tools are out-dated. The best practice approach?
Fast vulnerability intelligence, threat handling, and setup in one tool.

Read the new report on the Secunia VIM:
http://secunia.com/products/corporate/vim/ovum_2011_request/ 

----------------------------------------------------------------------

TITLE:
Moodle Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA46427

VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/46427/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=46427

RELEASE DATE:
2011-10-20

DISCUSS ADVISORY:
http://secunia.com/advisories/46427/#comments

AVAILABLE ON SITE AND IN CUSTOMER AREA:
 * Last Update
 * Popularity
 * Comments
 * Criticality Level
 * Impact
 * Where
 * Solution Status
 * Operating System / Software
 * CVE Reference(s)

http://secunia.com/advisories/46427/

ONLY AVAILABLE IN CUSTOMER AREA:
 * Authentication Level
 * Report Reliability
 * Secunia PoC
 * Secunia Analysis
 * Systems Affected
 * Approve Distribution
 * Remediation Status
 * Secunia CVSS Score
 * CVSS

https://ca.secunia.com/?page=viewadvisory&vuln_id=46427

ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
 * AUTOMATED SCANNING

http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/

DESCRIPTION:
Multiple weaknesses and vulnerabilities have been reported in Moodle,
which can be exploited by malicious users to bypass certain security
restrictions, disclose potentially sensitive data, conduct script
insertion attacks, manipulate certain data, and to cause a DoS
(Denial of Service) and by malicious people to bypass certain
security restrictions and conduct cross-site scripting and cross-site
request forgery attacks.

1) The weakness is caused due the chat feature allowing chat users to
enumerate the full names of users.

2) The weakness is caused due to the global search feature not
properly enforcing authorisation when being accessed through URLs
directly.

The weaknesses #1 and #2 do not affect the 1.9.x versions.

3) Incorrect handling of the return code of the "openssl_verify()"
function within the MNET feature can be exploited to bypass SSL
certificate validation.

4) A weakness in the Cookie-less session feature can potentially be
exploited to bypass certain security restrictions.

NOTE: The weakness affects the 1.9.x versions in the case of
misconfiguration only.

5) An unspecified error can be exploited to disclose user names to
unintended user groups.

6) Certain form data related to course section editing is not
properly sanitised before being returned to the user. This can be
exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site.

This vulnerability does not affect the 2.x versions.

7) Due to an error during installation procedures, a certain secret
value related to community hubs is not set.

8) The Box.net plugin does not implement the OAuth authentication
features of the application.

9) An error within the category and course areas of the server files
section can be exploited to disclose certain file information to
unintended user groups.

10) Input passed to the "section" parameter is not properly sanitised
before being returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser session in context
of an affected site.

11) Certain input related to wiki comments is not properly sanitised
before being used. This can be exploited to insert HTML and script
code, which will be executed in a user's browser session in context
of an affected site if malicious data is viewed.

12) The application allows users to perform certain actions via HTTP
requests without performing proper validity checks to verify the
requests. This can be exploited to e.g. perform certain actions on
links when a logged-in user visits a specially crafted web page.

The vulnerabilities #7 through #12 do not affect the 1.9.x versions.

13) An error related to forms can be exploited to manipulate certain
constant form values.

14) An error within message/refresh.php can be exploited to cause a
DoS by providing a zero value for the "wait" parameter.

NOTE: Additionally certain database functions were hardened to
prevent SQL injection attacks.

This vulnerability does not affect the 2.x versions.

SOLUTION:
Update to version 1.9.14, 2.0.5, or 2.1.2.

PROVIDED AND/OR DISCOVERED BY:
The vendor credits:
1, 4, 10, 11, 12) Petr Škoda
2) Tatsuya Shirai
3, 13) David Mudrak
5) Rossiani Wijaya
6) Aaron Barnes
7) Colin Campbell
8) Alex Willen
9) Ralf Hilgenstock
14) Xavier Paz

ORIGINAL ADVISORY:
Moodle (MSA-11-0027, MSA-11-0028, MSA-11-0029, MSA-11-0030,
MSA-11-0031, MSA-11-0032, MSA-11-0033, MSA-11-0034, MSA-11-0035,
MSA-11-0036, MSA-11-0037, MSA-11-0038, MSA-11-0039, MSA-11-0040,
MSA-11-0041):
http://moodle.org/mod/forum/discuss.php?d=188309
http://moodle.org/mod/forum/discuss.php?d=188310
http://moodle.org/mod/forum/discuss.php?d=188311
http://moodle.org/mod/forum/discuss.php?d=188312
http://moodle.org/mod/forum/discuss.php?d=188313
http://moodle.org/mod/forum/discuss.php?d=188314
http://moodle.org/mod/forum/discuss.php?d=188315
http://moodle.org/mod/forum/discuss.php?d=188316
http://moodle.org/mod/forum/discuss.php?d=188317
http://moodle.org/mod/forum/discuss.php?d=188318
http://moodle.org/mod/forum/discuss.php?d=188319
http://moodle.org/mod/forum/discuss.php?d=188320
http://moodle.org/mod/forum/discuss.php?d=188321
http://moodle.org/mod/forum/discuss.php?d=188322
http://moodle.org/mod/forum/discuss.php?d=188323

OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/

DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/

EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/

EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/

EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------