---------------------------------------------------------------------- Ovum says ad hoc tools are out-dated. The best practice approach? Fast vulnerability intelligence, threat handling, and setup in one tool. Read the new report on the Secunia VIM: http://secunia.com/products/corporate/vim/ovum_2011_request/ ---------------------------------------------------------------------- TITLE: Moodle Multiple Vulnerabilities SECUNIA ADVISORY ID: SA46427 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/46427/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=46427 RELEASE DATE: 2011-10-20 DISCUSS ADVISORY: http://secunia.com/advisories/46427/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/46427/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=46427 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Multiple weaknesses and vulnerabilities have been reported in Moodle, which can be exploited by malicious users to bypass certain security restrictions, disclose potentially sensitive data, conduct script insertion attacks, manipulate certain data, and to cause a DoS (Denial of Service) and by malicious people to bypass certain security restrictions and conduct cross-site scripting and cross-site request forgery attacks. 1) The weakness is caused due the chat feature allowing chat users to enumerate the full names of users. 2) The weakness is caused due to the global search feature not properly enforcing authorisation when being accessed through URLs directly. The weaknesses #1 and #2 do not affect the 1.9.x versions. 3) Incorrect handling of the return code of the "openssl_verify()" function within the MNET feature can be exploited to bypass SSL certificate validation. 4) A weakness in the Cookie-less session feature can potentially be exploited to bypass certain security restrictions. NOTE: The weakness affects the 1.9.x versions in the case of misconfiguration only. 5) An unspecified error can be exploited to disclose user names to unintended user groups. 6) Certain form data related to course section editing is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. This vulnerability does not affect the 2.x versions. 7) Due to an error during installation procedures, a certain secret value related to community hubs is not set. 8) The Box.net plugin does not implement the OAuth authentication features of the application. 9) An error within the category and course areas of the server files section can be exploited to disclose certain file information to unintended user groups. 10) Input passed to the "section" parameter is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. 11) Certain input related to wiki comments is not properly sanitised before being used. This can be exploited to insert HTML and script code, which will be executed in a user's browser session in context of an affected site if malicious data is viewed. 12) The application allows users to perform certain actions via HTTP requests without performing proper validity checks to verify the requests. This can be exploited to e.g. perform certain actions on links when a logged-in user visits a specially crafted web page. The vulnerabilities #7 through #12 do not affect the 1.9.x versions. 13) An error related to forms can be exploited to manipulate certain constant form values. 14) An error within message/refresh.php can be exploited to cause a DoS by providing a zero value for the "wait" parameter. NOTE: Additionally certain database functions were hardened to prevent SQL injection attacks. This vulnerability does not affect the 2.x versions. SOLUTION: Update to version 1.9.14, 2.0.5, or 2.1.2. PROVIDED AND/OR DISCOVERED BY: The vendor credits: 1, 4, 10, 11, 12) Petr Škoda 2) Tatsuya Shirai 3, 13) David Mudrak 5) Rossiani Wijaya 6) Aaron Barnes 7) Colin Campbell 8) Alex Willen 9) Ralf Hilgenstock 14) Xavier Paz ORIGINAL ADVISORY: Moodle (MSA-11-0027, MSA-11-0028, MSA-11-0029, MSA-11-0030, MSA-11-0031, MSA-11-0032, MSA-11-0033, MSA-11-0034, MSA-11-0035, MSA-11-0036, MSA-11-0037, MSA-11-0038, MSA-11-0039, MSA-11-0040, MSA-11-0041): http://moodle.org/mod/forum/discuss.php?d=188309 http://moodle.org/mod/forum/discuss.php?d=188310 http://moodle.org/mod/forum/discuss.php?d=188311 http://moodle.org/mod/forum/discuss.php?d=188312 http://moodle.org/mod/forum/discuss.php?d=188313 http://moodle.org/mod/forum/discuss.php?d=188314 http://moodle.org/mod/forum/discuss.php?d=188315 http://moodle.org/mod/forum/discuss.php?d=188316 http://moodle.org/mod/forum/discuss.php?d=188317 http://moodle.org/mod/forum/discuss.php?d=188318 http://moodle.org/mod/forum/discuss.php?d=188319 http://moodle.org/mod/forum/discuss.php?d=188320 http://moodle.org/mod/forum/discuss.php?d=188321 http://moodle.org/mod/forum/discuss.php?d=188322 http://moodle.org/mod/forum/discuss.php?d=188323 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------