Detections
Analytics
Debian DSA-1986-1 : moodle - several vulnerabilities
medium Nessus Plugin ID 44850
Language:
Synopsis
The remote Debian host is missing a security-related update.Description
Several vulnerabilities have been discovered in Moodle, an online course management system. The Common Vulnerabilities and Exposures project identifies the following problems :- CVE-2009-4297 Multiple cross-site request forgery (CSRF) vulnerabilities have been discovered.
- CVE-2009-4298 It has been discovered that the LAMS module is prone to the disclosure of user account information.
- CVE-2009-4299 The Glossary module has an insufficient access control mechanism.
- CVE-2009-4301 Moodle does not properly check permissions when the MNET service is enabled, which allows remote authenticated servers to execute arbitrary MNET functions.
- CVE-2009-4302 The login/index_form.html page links to an HTTP page instead of using an SSL secured connection.
- CVE-2009-4303 Moodle stores sensitive data in backup files, which might make it possible for attackers to obtain them.
- CVE-2009-4305 It has been discovered that the SCORM module is prone to a SQL injection.
Additionally, a SQL injection in the update_record function, a problem with symbolic links and a verification problem with Glossary, database and forum ratings have been fixed.
Solution
Upgrade the moodle packages.For the stable distribution (lenny), these problems have been fixed in version 1.8.2.dfsg-3+lenny3.
For the oldstable distribution (etch), there are no fixed packages available and it is too hard to backport many of the fixes. Therefore, we recommend to upgrade to the lenny version.
See Also
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=559531
https://security-tracker.debian.org/tracker/CVE-2009-4297
https://security-tracker.debian.org/tracker/CVE-2009-4298
https://security-tracker.debian.org/tracker/CVE-2009-4299
https://security-tracker.debian.org/tracker/CVE-2009-4301
https://security-tracker.debian.org/tracker/CVE-2009-4302
https://security-tracker.debian.org/tracker/CVE-2009-4303
Plugin Details
Severity: Medium
ID: 44850
File Name: debian_DSA-1986.nasl
Version: 1.13
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 2/24/2010
Updated: 1/4/2021
Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:moodle, cpe:/o:debian:debian_linux:5.0
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Patch Publication Date: 2/2/2010
Reference Information
CVE: CVE-2009-4297, CVE-2009-4298, CVE-2009-4299, CVE-2009-4301, CVE-2009-4302, CVE-2009-4303, CVE-2009-4305