The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cross-site scripting (XSS) attacks via a string containing crafted URL protocols.

Several vulnerabilities have been discovered in wordpress, weblog manager. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-6762     It was discovered that wordpress is prone to an open     redirect vulnerability which allows remote attackers to     conduct phishing attacks.

  - CVE-2008-6767     It was discovered that remote attackers had the ability     to trigger an application upgrade, which could lead to a     denial of service attack.

  - CVE-2009-2334     It was discovered that wordpress lacks authentication     checks in the plugin configuration, which might leak     sensitive information.

  - CVE-2009-2854     It was discovered that wordpress lacks authentication     checks in various actions, thus allowing remote     attackers to produce unauthorised edits or additions.

  - CVE-2009-2851     It was discovered that the administrator interface is     prone to a cross-site scripting attack.

  - CVE-2009-2853     It was discovered that remote attackers can gain     privileges via certain direct requests.

  - CVE-2008-1502     It was discovered that the _bad_protocol_once function     in KSES, as used by wordpress, allows remote attackers     to perform cross-site scripting attacks.

  - CVE-2008-4106     It was discovered that wordpress lacks certain checks     around user information, which could be used by     attackers to change the password of a user.

  - CVE-2008-4769     It was discovered that the get_category_template     function is prone to a directory traversal     vulnerability, which could lead to the execution of     arbitrary code.

  - CVE-2008-4796     It was discovered that the _httpsrequest function in the     embedded snoopy version is prone to the execution of     arbitrary commands via shell metacharacters in https     URLs.

  - CVE-2008-5113     It was discovered that wordpress relies on the REQUEST     superglobal array in certain dangerous situations, which     makes it easier to perform attacks via crafted cookies.

Lukasz Pilorz discovered that the HTML filtering used in Moodle was not strict enough. A remote attacker could send malicious requests to Moodle and execute arbitrary code as the web server user.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several remote vulnerabilities have been discovered in Moodle, an online course management system. The following issues are addressed in this update, ranging from cross site scripting to remote code execution.

Various cross site scripting issues in the Moodle codebase (CVE-2008-3326, CVE-2008-3325, CVE-2007-3555, CVE-2008-5432, MSA-08-0021, MDL-8849, MDL-12793, MDL-11414, MDL-14806, MDL-10276).

Various cross site request forgery issues in the Moodle codebase (CVE-2008-3325, MSA-08-0023).

Privilege escalation bugs in the Moodle codebase (MSA-08-0001, MDL-7755).

SQL injection issue in the hotpot module (MSA-08-0010).

An embedded copy of Smarty had several vulnerabilities (CVE-2008-4811, CVE-2008-4810 ). An embedded copy of Snoopy was vulnerable to cross site scripting (CVE-2008-4796 ). An embedded copy of Kses was vulnerable to cross site scripting (CVE-2008-1502 ).

An incorrect input validation in moodle could be exploited by attackers to conduct cross site scripting attacks (CVE-2008-1502).

Security fixes, updated language packs.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200805-04 (eGroupWare: Multiple vulnerabilities)

    A vulnerability has been reported in FCKEditor due to the way that file     uploads are handled in the file     editor/filemanager/upload/php/upload.php when a filename has multiple     file extensions (CVE-2008-2041). Another vulnerability exists in the
    _bad_protocol_once() function in the file     phpgwapi/inc/class.kses.inc.php, which allows remote attackers to     bypass HTML filtering (CVE-2008-1502).
  Impact :

    The first vulnerability can be exploited to upload malicious files and     execute arbitrary PHP code provided that a directory is writable by the     webserver. The second vulnerability can be exploited by remote     attackers via a specially crafted URL in order to conduct cross-site     scripting attacks.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
44736	Debian DSA-1871-1 : wordpress - several vulnerabilities	Nessus	Debian Local Security Checks	critical
36491	Ubuntu 7.10 / 8.04 LTS : moodle vulnerability (USN-658-1)	Nessus	Ubuntu Local Security Checks	medium
35254	Debian DSA-1691-1 : moodle - several vulnerabilities	Nessus	Debian Local Security Checks	critical
33513	openSUSE 10 Security Update : moodle (moodle-5439)	Nessus	SuSE Local Security Checks	medium
33459	Fedora 8 : moodle-1.8.5-1.fc8 (2008-6226)	Nessus	Fedora Local Security Checks	medium
32152	GLSA-200805-04 : eGroupWare: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2008-1502

medium

Tenable Plugins

critical

medium

critical

medium

medium

critical