[SECURITY] [DSA 1691-1] New moodle packages fix several vulnerabilities

Debian Security Advisory DSA-1691-1 [email protected]
http://www.debian.org/security/ Thijs Kinkhorst
December 22, 2008 http://www.debian.org/security/faq

Package : moodle
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE Id(s) : CVE-2007-3555 CVE-2008-1502 CVE-2008-3325 CVE-2008-3326
CVE-2008-4796 CVE-2008-4810 CVE-2008-4811 CVE-2008-5432
Debian Bugs : 432264 471158 489533 492492 504235 504345 508593

Several remote vulnerabilities have been discovered in Moodle, an online
course management system. The following issues are addressed in this
update, ranging from cross site scripting to remote code execution.

Various cross site scripting issues in the Moodle codebase
(CVE-2008-3326, CVE-2008-3325, CVE-2007-3555, CVE-2008-5432,
MSA-08-0021, MDL-8849, MDL-12793, MDL-11414, MDL-14806,
MDL-10276).

Various cross site request forgery issues in the Moodle codebase
(CVE-2008-3325, MSA-08-0023).

Privilege escalation bugs in the Moodle codebase (MSA-08-0001, MDL-7755).

SQL injection issue in the hotpot module (MSA-08-0010).

An embedded copy of Smarty had several vulnerabilities
(CVE-2008-4811, CVE-2008-4810).
An embedded copy of Snoopy was vulnerable to cross site scripting
(CVE-2008-4796).
An embedded copy of Kses was vulnerable to cross site scripting
(CVE-2008-1502).

For the stable distribution (etch), these problems have been fixed in
version 1.6.3-2+etch1.

For the unstable distribution (sid), these problems have been fixed in
version 1.8.2.dfsg-2.

We recommend that you upgrade your moodle (1.6.3-2+etch1) package.

Upgrade instructions

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 4.0 alias etch

Source archives:

http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+etch1.diff.gz
Size/MD5 checksum: 24019 d29c179786ca1dcadf232c5e9a601362
http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3.orig.tar.gz
Size/MD5 checksum: 7465709 2f9f3fcf83ab0f18c409f3a48e07eae2
http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+etch1.dsc
Size/MD5 checksum: 793 d9a1fceaf316b608709be372d97e667a

Architecture independent packages:

http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+etch1_all.deb
Size/MD5 checksum: 6592474 9a5fb5924faa639952c3171665bc347d

These files will probably be moved into the stable distribution on
its next update.

For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: [email protected]
Package info: `apt-cache show <pkg>' and http://packages.debian.org/&lt;pkg&gt;