A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS     protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that     allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to     validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to     validation/Cas20ServiceTicketValidator.java. (CVE-2014-4172)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote web server hosts Moodle, an open-source course management system. Versions of Moodle 2.5.x prior to 2.5.8, 2.6.x prior to 2.6.5, 2.7.x prior to 2.7.2, and all previous releases are exposed to the following vulnerabilities :

  - A security bypass vulnerability affects the third-party library utilized by Moodle, phpCAS. Specifically, this is a flaw related to improper URL encoding in the back-channel ticket validation. With a specially crafted request, a remote attacker can bypass intended security constraints. (MSA-14-0033 / CVE-2014-4172)

  - An information disclosure vulnerability affects the Q&A forum. Specifically, this affects the script '/mod/forum/view.php' by allowing users who had not yet posted the required answer to see the name of the last person who had posted their answer. (MSA-14-0034 / CVE-2014-3617)

Marvin S. Addison discovered that Jasig phpCAS, a PHP library for the CAS authentication protocol, did not encode tickets before adding them to an URL, creating a possibility for cross site scripting.

- update to 3.3.3

    - fix CVE-2014-4172 (rhbz#1131371)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
218113	Linux Distros Unpatched Vulnerability : CVE-2014-4172	Nessus	Misc.	critical
8719	Moodle < 2.5 / 2.5.x < 2.5.8 / 2.6.x < 2.6.5 / 2.7.x < 2.7.2 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
77510	Debian DSA-3017-1 : php-cas - security update	Nessus	Debian Local Security Checks	critical
77449	Fedora 20 : cas-client-3.3.3-1.fc20 (2014-9662)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2014-4172

critical

Tenable Plugins

critical

medium

critical

medium