Debian DSA-1924-1 : mahara - several vulnerabilities
2010-02-24T00:00:00
ID DEBIAN_DSA-1924.NASL Type nessus Reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. Modified 2019-11-02T00:00:00
Description
Two vulnerabilities have been discovered in mahara, an electronic
portfolio, weblog, and resume builder. The Common Vulnerabilities and
Exposures project identifies the following problems :
CVE-2009-3298
Ruslan Kabalin discovered a issue with resetting
passwords, which could lead to a privilege escalation of
an institutional administrator account.
CVE-2009-3299
Sven Vetsch discovered a cross-site scripting
vulnerability via the resume fields.
#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory DSA-1924. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#
include("compat.inc");
if (description)
{
script_id(44789);
script_version("1.11");
script_cvs_date("Date: 2019/08/02 13:32:22");
script_cve_id("CVE-2009-3298", "CVE-2009-3299");
script_xref(name:"DSA", value:"1924");
script_name(english:"Debian DSA-1924-1 : mahara - several vulnerabilities");
script_summary(english:"Checks dpkg output for the updated package");
script_set_attribute(
attribute:"synopsis",
value:"The remote Debian host is missing a security-related update."
);
script_set_attribute(
attribute:"description",
value:
"Two vulnerabilities have been discovered in mahara, an electronic
portfolio, weblog, and resume builder. The Common Vulnerabilities and
Exposures project identifies the following problems :
- CVE-2009-3298
Ruslan Kabalin discovered a issue with resetting
passwords, which could lead to a privilege escalation of
an institutional administrator account.
- CVE-2009-3299
Sven Vetsch discovered a cross-site scripting
vulnerability via the resume fields."
);
script_set_attribute(
attribute:"see_also",
value:"https://security-tracker.debian.org/tracker/CVE-2009-3298"
);
script_set_attribute(
attribute:"see_also",
value:"https://security-tracker.debian.org/tracker/CVE-2009-3299"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.debian.org/security/2009/dsa-1924"
);
script_set_attribute(
attribute:"solution",
value:
"Upgrade the mahara packages.
For the stable distribution (lenny), these problems have been fixed in
version 1.0.4-4+lenny4.
The oldstable distribution (etch) does not contain mahara."
);
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
script_cwe_id(79, 264);
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:mahara");
script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:5.0");
script_set_attribute(attribute:"patch_publication_date", value:"2009/10/31");
script_set_attribute(attribute:"plugin_publication_date", value:"2010/02/24");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_family(english:"Debian Local Security Checks");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
exit(0);
}
include("audit.inc");
include("debian_package.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
flag = 0;
if (deb_check(release:"5.0", prefix:"mahara", reference:"1.0.4-4+lenny4")) flag++;
if (deb_check(release:"5.0", prefix:"mahara-apache2", reference:"1.0.4-4+lenny4")) flag++;
if (flag)
{
if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
else security_warning(0);
exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");
{"id": "DEBIAN_DSA-1924.NASL", "bulletinFamily": "scanner", "title": "Debian DSA-1924-1 : mahara - several vulnerabilities", "description": "Two vulnerabilities have been discovered in mahara, an electronic\nportfolio, weblog, and resume builder. The Common Vulnerabilities and\nExposures project identifies the following problems :\n\n - CVE-2009-3298\n Ruslan Kabalin discovered a issue with resetting\n passwords, which could lead to a privilege escalation of\n an institutional administrator account.\n\n - CVE-2009-3299\n Sven Vetsch discovered a cross-site scripting\n vulnerability via the resume fields.", "published": "2010-02-24T00:00:00", "modified": "2019-11-02T00:00:00", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}, "href": "https://www.tenable.com/plugins/nessus/44789", "reporter": "This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://security-tracker.debian.org/tracker/CVE-2009-3299", "https://www.debian.org/security/2009/dsa-1924", "https://security-tracker.debian.org/tracker/CVE-2009-3298"], "cvelist": ["CVE-2009-3298", "CVE-2009-3299"], "type": "nessus", "lastseen": "2019-11-01T02:21:05", "history": [{"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/o:debian:debian_linux:5.0", "p-cpe:/a:debian:debian_linux:mahara"], "cvelist": ["CVE-2009-3298", "CVE-2009-3299"], "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}, "description": "Two vulnerabilities have been discovered in mahara, an electronic\nportfolio, weblog, and resume builder. The Common Vulnerabilities and\nExposures project identifies the following problems :\n\n - CVE-2009-3298\n Ruslan Kabalin discovered a issue with resetting\n passwords, which could lead to a privilege escalation of\n an institutional administrator account.\n\n - CVE-2009-3299\n Sven Vetsch discovered a cross-site scripting\n vulnerability via the resume fields.", "edition": 11, "enchantments": {"dependencies": {"modified": "2019-10-28T20:05:51", "references": [{"idList": ["DEBIAN:DSA-1924-1:92909"], "type": "debian"}, {"idList": ["CVE-2009-3298", "CVE-2009-3299"], "type": "cve"}, {"idList": ["SSV:12672"], "type": "seebug"}, {"idList": ["OPENVAS:1361412562310100334", "OPENVAS:136141256231066204", "OPENVAS:66204", "OPENVAS:100334"], "type": "openvas"}, {"idList": ["SECURITYVULNS:DOC:22726", "SECURITYVULNS:VULN:10367"], "type": "securityvulns"}]}, "score": {"modified": "2019-10-28T20:05:51", "value": 7.1, "vector": "NONE"}}, "hash": "4ebb56604d171946801b500735babccf5c428e150c1d65202fa3564414bc50ee", "hashmap": [{"hash": "c611127b94520ac5dacf8e2102c581ba", "key": "pluginID"}, {"hash": "0187fd86f792b6c1e0077d0f69d0ed79", "key": "cvss"}, {"hash": "9b0e46dace93367b7e91f251d817f95a", "key": "reporter"}, {"hash": "c6b90bd9f519d374a041142072c62247", "key": "description"}, {"hash": "8c74180925c82d9a81691ea9a4762329", "key": "cpe"}, {"hash": "acb475d9c69c42b76d7f70625d1b596b", "key": "title"}, {"hash": "310f9970d61e38a9e9b575e7abd91416", "key": "href"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "0bafb6325bcaf483a25404f785191cc5", "key": "modified"}, {"hash": "b8a17c54fad8f9fe04b8c825b00819e4", "key": "published"}, {"hash": "a29f0dd5372931fb17e7444b6807d9e4", "key": "cvelist"}, {"hash": "74562d71b087df9eabd0c21f99b132cc", "key": "naslFamily"}, {"hash": "5433d8683dba3ea5459d0c41d87a9697", "key": "references"}, {"hash": "354bf94c9aad5f013bed41eafadebf39", "key": "sourceData"}], "history": [], "href": "https://www.tenable.com/plugins/nessus/44789", "id": "DEBIAN_DSA-1924.NASL", "lastseen": "2019-10-28T20:05:51", "modified": "2019-10-02T00:00:00", "naslFamily": "Debian Local Security Checks", "objectVersion": "1.3", "pluginID": "44789", "published": "2010-02-24T00:00:00", "references": ["https://security-tracker.debian.org/tracker/CVE-2009-3299", "https://www.debian.org/security/2009/dsa-1924", "https://security-tracker.debian.org/tracker/CVE-2009-3298"], "reporter": "This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.", "sourceData": "#%NASL_MIN_LEVEL 80502\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-1924. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(44789);\n script_version(\"1.11\");\n script_cvs_date(\"Date: 2019/08/02 13:32:22\");\n\n script_cve_id(\"CVE-2009-3298\", \"CVE-2009-3299\");\n script_xref(name:\"DSA\", value:\"1924\");\n\n script_name(english:\"Debian DSA-1924-1 : mahara - several vulnerabilities\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Two vulnerabilities have been discovered in mahara, an electronic\nportfolio, weblog, and resume builder. The Common Vulnerabilities and\nExposures project identifies the following problems :\n\n - CVE-2009-3298\n Ruslan Kabalin discovered a issue with resetting\n passwords, which could lead to a privilege escalation of\n an institutional administrator account.\n\n - CVE-2009-3299\n Sven Vetsch discovered a cross-site scripting\n vulnerability via the resume fields.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2009-3298\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2009-3299\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2009/dsa-1924\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the mahara packages.\n\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1.0.4-4+lenny4.\n\nThe oldstable distribution (etch) does not contain mahara.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_cwe_id(79, 264);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:mahara\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:5.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/10/31\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/02/24\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"5.0\", prefix:\"mahara\", reference:\"1.0.4-4+lenny4\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"mahara-apache2\", reference:\"1.0.4-4+lenny4\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "title": "Debian DSA-1924-1 : mahara - several vulnerabilities", "type": "nessus", "viewCount": 10}, "differentElements": ["modified"], "edition": 11, "lastseen": "2019-10-28T20:05:51"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/o:debian:debian_linux:5.0", "p-cpe:/a:debian:debian_linux:mahara"], "cvelist": ["CVE-2009-3298", "CVE-2009-3299"], "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "Two vulnerabilities have been discovered in mahara, an electronic portfolio, weblog, and resume builder. The Common Vulnerabilities and Exposures project identifies the following problems :\n\n - CVE-2009-3298 Ruslan Kabalin discovered a issue with resetting passwords, which could lead to a privilege escalation of an institutional administrator account.\n\n - CVE-2009-3299 Sven Vetsch discovered a cross-site scripting vulnerability via the resume fields.", "edition": 6, "enchantments": {"score": {"value": 4.3, "vector": "NONE"}}, "hash": "209d2bda29f75c6d314565c01d5b200cef0deb201c077b4dc3c551976f173860", "hashmap": [{"hash": "ec63363ea97f525054bb9df7afbaa455", "key": "description"}, {"hash": "b5506bf5fba35be2b8f2674cdf696e1d", "key": "sourceData"}, {"hash": "c611127b94520ac5dacf8e2102c581ba", "key": "pluginID"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "3b6df54a1c4b053d686809a6dba09da0", "key": "references"}, {"hash": "8c74180925c82d9a81691ea9a4762329", "key": "cpe"}, {"hash": "acb475d9c69c42b76d7f70625d1b596b", "key": "title"}, {"hash": "9acfc3ecd06539a3534549fd05dfad8e", "key": "cvss"}, {"hash": "a03d359fb0b4e439f50091cee1f89df6", "key": "modified"}, {"hash": "d60e98c07071ef8526b6eb288c8984e4", "key": "href"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "b8a17c54fad8f9fe04b8c825b00819e4", "key": "published"}, {"hash": "a29f0dd5372931fb17e7444b6807d9e4", "key": "cvelist"}, {"hash": "74562d71b087df9eabd0c21f99b132cc", "key": "naslFamily"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=44789", "id": "DEBIAN_DSA-1924.NASL", "lastseen": "2018-09-01T23:34:55", "modified": "2018-08-09T00:00:00", "naslFamily": "Debian Local Security Checks", "objectVersion": "1.3", "pluginID": "44789", "published": "2010-02-24T00:00:00", "references": ["https://security-tracker.debian.org/tracker/CVE-2009-3299", "http://www.debian.org/security/2009/dsa-1924", "https://security-tracker.debian.org/tracker/CVE-2009-3298"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-1924. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(44789);\n script_version(\"1.9\");\n script_cvs_date(\"Date: 2018/08/09 17:06:37\");\n\n script_cve_id(\"CVE-2009-3298\", \"CVE-2009-3299\");\n script_xref(name:\"DSA\", value:\"1924\");\n\n script_name(english:\"Debian DSA-1924-1 : mahara - several vulnerabilities\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Two vulnerabilities have been discovered in mahara, an electronic\nportfolio, weblog, and resume builder. The Common Vulnerabilities and\nExposures project identifies the following problems :\n\n - CVE-2009-3298\n Ruslan Kabalin discovered a issue with resetting\n passwords, which could lead to a privilege escalation of\n an institutional administrator account.\n\n - CVE-2009-3299\n Sven Vetsch discovered a cross-site scripting\n vulnerability via the resume fields.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2009-3298\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2009-3299\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.debian.org/security/2009/dsa-1924\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the mahara packages.\n\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1.0.4-4+lenny4.\n\nThe oldstable distribution (etch) does not contain mahara.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_cwe_id(79, 264);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:mahara\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:5.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/10/31\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/02/24\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"5.0\", prefix:\"mahara\", reference:\"1.0.4-4+lenny4\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"mahara-apache2\", reference:\"1.0.4-4+lenny4\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "title": "Debian DSA-1924-1 : mahara - several vulnerabilities", "type": "nessus", "viewCount": 3}, "differentElements": ["sourceData"], "edition": 6, "lastseen": "2018-09-01T23:34:55"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["cpe:/o:debian:debian_linux:5.0", "p-cpe:/a:debian:debian_linux:mahara"], "cvelist": ["CVE-2009-3298", "CVE-2009-3299"], "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "Two vulnerabilities have been discovered in mahara, an electronic portfolio, weblog, and resume builder. The Common Vulnerabilities and Exposures project identifies the following problems :\n\n - CVE-2009-3298 Ruslan Kabalin discovered a issue with resetting passwords, which could lead to a privilege escalation of an institutional administrator account.\n\n - CVE-2009-3299 Sven Vetsch discovered a cross-site scripting vulnerability via the resume fields.", "edition": 4, "enchantments": {"score": {"value": 4.3, "vector": "NONE"}}, "hash": "209d2bda29f75c6d314565c01d5b200cef0deb201c077b4dc3c551976f173860", "hashmap": [{"hash": "ec63363ea97f525054bb9df7afbaa455", "key": "description"}, {"hash": "b5506bf5fba35be2b8f2674cdf696e1d", "key": "sourceData"}, {"hash": "c611127b94520ac5dacf8e2102c581ba", "key": "pluginID"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "3b6df54a1c4b053d686809a6dba09da0", "key": "references"}, {"hash": "8c74180925c82d9a81691ea9a4762329", "key": "cpe"}, {"hash": "acb475d9c69c42b76d7f70625d1b596b", "key": "title"}, {"hash": "9acfc3ecd06539a3534549fd05dfad8e", "key": "cvss"}, {"hash": "a03d359fb0b4e439f50091cee1f89df6", "key": "modified"}, {"hash": "d60e98c07071ef8526b6eb288c8984e4", "key": "href"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "b8a17c54fad8f9fe04b8c825b00819e4", "key": "published"}, {"hash": "a29f0dd5372931fb17e7444b6807d9e4", "key": "cvelist"}, {"hash": "74562d71b087df9eabd0c21f99b132cc", "key": "naslFamily"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=44789", "id": "DEBIAN_DSA-1924.NASL", "lastseen": "2018-08-10T16:57:39", "modified": "2018-08-09T00:00:00", "naslFamily": "Debian Local Security Checks", "objectVersion": "1.3", "pluginID": "44789", "published": "2010-02-24T00:00:00", "references": ["https://security-tracker.debian.org/tracker/CVE-2009-3299", "http://www.debian.org/security/2009/dsa-1924", "https://security-tracker.debian.org/tracker/CVE-2009-3298"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-1924. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(44789);\n script_version(\"1.9\");\n script_cvs_date(\"Date: 2018/08/09 17:06:37\");\n\n script_cve_id(\"CVE-2009-3298\", \"CVE-2009-3299\");\n script_xref(name:\"DSA\", value:\"1924\");\n\n script_name(english:\"Debian DSA-1924-1 : mahara - several vulnerabilities\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Two vulnerabilities have been discovered in mahara, an electronic\nportfolio, weblog, and resume builder. The Common Vulnerabilities and\nExposures project identifies the following problems :\n\n - CVE-2009-3298\n Ruslan Kabalin discovered a issue with resetting\n passwords, which could lead to a privilege escalation of\n an institutional administrator account.\n\n - CVE-2009-3299\n Sven Vetsch discovered a cross-site scripting\n vulnerability via the resume fields.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2009-3298\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2009-3299\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.debian.org/security/2009/dsa-1924\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the mahara packages.\n\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1.0.4-4+lenny4.\n\nThe oldstable distribution (etch) does not contain mahara.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_cwe_id(79, 264);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:mahara\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:5.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/10/31\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/02/24\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"5.0\", prefix:\"mahara\", reference:\"1.0.4-4+lenny4\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"mahara-apache2\", reference:\"1.0.4-4+lenny4\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "title": "Debian DSA-1924-1 : mahara - several vulnerabilities", "type": "nessus", "viewCount": 2}, "differentElements": ["cvss"], "edition": 4, "lastseen": "2018-08-10T16:57:39"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": [], "cvelist": ["CVE-2009-3298", "CVE-2009-3299"], "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "Two vulnerabilities have been discovered in mahara, an electronic portfolio, weblog, and resume builder. The Common Vulnerabilities and Exposures project identifies the following problems :\n\n - CVE-2009-3298 Ruslan Kabalin discovered a issue with resetting passwords, which could lead to a privilege escalation of an institutional administrator account.\n\n - CVE-2009-3299 Sven Vetsch discovered a cross-site scripting vulnerability via the resume fields.", "edition": 2, "enchantments": {}, "hash": "853d7c76fe9727a55adc4ce50bf797e869670c5a5d447496d66ad379ed0036d9", "hashmap": [{"hash": "ec63363ea97f525054bb9df7afbaa455", "key": "description"}, {"hash": "c611127b94520ac5dacf8e2102c581ba", "key": "pluginID"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "3b6df54a1c4b053d686809a6dba09da0", "key": "references"}, {"hash": "65e7475eb4d6033c5722200e6229fcfc", "key": "sourceData"}, {"hash": "acb475d9c69c42b76d7f70625d1b596b", "key": "title"}, {"hash": "9acfc3ecd06539a3534549fd05dfad8e", "key": "cvss"}, {"hash": "d60e98c07071ef8526b6eb288c8984e4", "key": "href"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "85b7e791660ffca0810fc1090e70d80f", "key": "modified"}, {"hash": "b8a17c54fad8f9fe04b8c825b00819e4", "key": "published"}, {"hash": "a29f0dd5372931fb17e7444b6807d9e4", "key": "cvelist"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}, {"hash": "74562d71b087df9eabd0c21f99b132cc", "key": "naslFamily"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=44789", "id": "DEBIAN_DSA-1924.NASL", "lastseen": "2016-12-07T05:33:28", "modified": "2016-12-06T00:00:00", "naslFamily": "Debian Local Security Checks", "objectVersion": "1.2", "pluginID": "44789", "published": "2010-02-24T00:00:00", "references": ["https://security-tracker.debian.org/tracker/CVE-2009-3299", "http://www.debian.org/security/2009/dsa-1924", "https://security-tracker.debian.org/tracker/CVE-2009-3298"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-1924. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(44789);\n script_version(\"$Revision: 1.8 $\");\n script_cvs_date(\"$Date: 2016/12/06 20:12:52 $\");\n\n script_cve_id(\"CVE-2009-3298\", \"CVE-2009-3299\");\n script_osvdb_id(59583, 59584);\n script_xref(name:\"DSA\", value:\"1924\");\n\n script_name(english:\"Debian DSA-1924-1 : mahara - several vulnerabilities\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Two vulnerabilities have been discovered in mahara, an electronic\nportfolio, weblog, and resume builder. The Common Vulnerabilities and\nExposures project identifies the following problems :\n\n - CVE-2009-3298\n Ruslan Kabalin discovered a issue with resetting\n passwords, which could lead to a privilege escalation of\n an institutional administrator account.\n\n - CVE-2009-3299\n Sven Vetsch discovered a cross-site scripting\n vulnerability via the resume fields.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2009-3298\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2009-3299\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.debian.org/security/2009/dsa-1924\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the mahara packages.\n\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1.0.4-4+lenny4.\n\nThe oldstable distribution (etch) does not contain mahara.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_cwe_id(79, 264);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:mahara\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:5.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/10/31\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/02/24\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2016 Tenable Network Security, Inc.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"5.0\", prefix:\"mahara\", reference:\"1.0.4-4+lenny4\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"mahara-apache2\", reference:\"1.0.4-4+lenny4\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "title": "Debian DSA-1924-1 : mahara - several vulnerabilities", "type": "nessus", "viewCount": 1}, "differentElements": ["cpe"], "edition": 2, "lastseen": "2016-12-07T05:33:28"}, {"bulletin": {"bulletinFamily": "exploit", "cvelist": ["CVE-2009-3298", "CVE-2009-3299"], "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "Two vulnerabilities have been discovered in mahara, an electronic portfolio, weblog, and resume builder. The Common Vulnerabilities and Exposures project identifies the following problems :\n\n - CVE-2009-3298 Ruslan Kabalin discovered a issue with resetting passwords, which could lead to a privilege escalation of an institutional administrator account.\n\n - CVE-2009-3299 Sven Vetsch discovered a cross-site scripting vulnerability via the resume fields.", "edition": 1, "hash": "f9134d432364473d68aad54a723ec7d1a25fd7ebeefe57489be04beb1289ff5f", "hashmap": [{"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "ec63363ea97f525054bb9df7afbaa455", "key": "description"}, {"hash": "c611127b94520ac5dacf8e2102c581ba", "key": "pluginID"}, {"hash": "56765472680401499c79732468ba4340", "key": "objectVersion"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "3b6df54a1c4b053d686809a6dba09da0", "key": "references"}, {"hash": "acb475d9c69c42b76d7f70625d1b596b", "key": "title"}, {"hash": "9acfc3ecd06539a3534549fd05dfad8e", "key": "cvss"}, {"hash": "d60e98c07071ef8526b6eb288c8984e4", "key": "href"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "58e36873cc722bb45204800266380b16", "key": "modified"}, {"hash": "d5790e61322c42a8f0e941d483f4d36e", "key": "sourceData"}, {"hash": "b8a17c54fad8f9fe04b8c825b00819e4", "key": "published"}, {"hash": "a29f0dd5372931fb17e7444b6807d9e4", "key": "cvelist"}, {"hash": "74562d71b087df9eabd0c21f99b132cc", "key": "naslFamily"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=44789", "id": "DEBIAN_DSA-1924.NASL", "lastseen": "2016-09-26T17:23:27", "modified": "2014-05-03T00:00:00", "naslFamily": "Debian Local Security Checks", "objectVersion": "1.2", "pluginID": "44789", "published": "2010-02-24T00:00:00", "references": ["https://security-tracker.debian.org/tracker/CVE-2009-3299", "http://www.debian.org/security/2009/dsa-1924", "https://security-tracker.debian.org/tracker/CVE-2009-3298"], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-1924. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(44789);\n script_version(\"$Revision: 1.7 $\");\n script_cvs_date(\"$Date: 2014/05/03 11:20:10 $\");\n\n script_cve_id(\"CVE-2009-3298\", \"CVE-2009-3299\");\n script_osvdb_id(59583, 59584);\n script_xref(name:\"DSA\", value:\"1924\");\n\n script_name(english:\"Debian DSA-1924-1 : mahara - several vulnerabilities\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Two vulnerabilities have been discovered in mahara, an electronic\nportfolio, weblog, and resume builder. The Common Vulnerabilities and\nExposures project identifies the following problems :\n\n - CVE-2009-3298\n Ruslan Kabalin discovered a issue with resetting\n passwords, which could lead to a privilege escalation of\n an institutional administrator account.\n\n - CVE-2009-3299\n Sven Vetsch discovered a cross-site scripting\n vulnerability via the resume fields.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2009-3298\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2009-3299\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.debian.org/security/2009/dsa-1924\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the mahara packages.\n\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1.0.4-4+lenny4.\n\nThe oldstable distribution (etch) does not contain mahara.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_cwe_id(79);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:mahara\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:5.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/10/31\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/02/24\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2014 Tenable Network Security, Inc.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"5.0\", prefix:\"mahara\", reference:\"1.0.4-4+lenny4\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"mahara-apache2\", reference:\"1.0.4-4+lenny4\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "title": "Debian DSA-1924-1 : mahara - several vulnerabilities", "type": "nessus", "viewCount": 0}, "differentElements": ["modified", "sourceData"], "edition": 1, "lastseen": "2016-09-26T17:23:27"}], "edition": 12, "hashmap": [{"key": "bulletinFamily", "hash": "bbdaea376f500d25f6b0c1050311dd07"}, {"key": "cpe", "hash": "8c74180925c82d9a81691ea9a4762329"}, {"key": "cvelist", "hash": "a29f0dd5372931fb17e7444b6807d9e4"}, {"key": "cvss", "hash": "0187fd86f792b6c1e0077d0f69d0ed79"}, {"key": "description", "hash": "c6b90bd9f519d374a041142072c62247"}, {"key": "href", "hash": "310f9970d61e38a9e9b575e7abd91416"}, {"key": "modified", "hash": "abcf9266f425f12dda38f529cd4a94bc"}, {"key": "naslFamily", "hash": "74562d71b087df9eabd0c21f99b132cc"}, {"key": "pluginID", "hash": "c611127b94520ac5dacf8e2102c581ba"}, {"key": "published", "hash": "b8a17c54fad8f9fe04b8c825b00819e4"}, {"key": "references", "hash": "5433d8683dba3ea5459d0c41d87a9697"}, {"key": "reporter", "hash": "9b0e46dace93367b7e91f251d817f95a"}, {"key": "sourceData", "hash": "354bf94c9aad5f013bed41eafadebf39"}, {"key": "title", "hash": "acb475d9c69c42b76d7f70625d1b596b"}, {"key": "type", "hash": "5e0bd03bec244039678f2b955a2595aa"}], "hash": "231efd1b9d347ff2c7250ecbecbd4b6116b9de1c28b1674f4a9b28692a912d65", "viewCount": 10, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2009-3299", "CVE-2009-3298"]}, {"type": "openvas", "idList": ["OPENVAS:100334", "OPENVAS:66204", "OPENVAS:136141256231066204", "OPENVAS:1361412562310100334"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:22726", "SECURITYVULNS:VULN:10367"]}, {"type": "debian", "idList": ["DEBIAN:DSA-1924-1:92909"]}, {"type": "seebug", "idList": ["SSV:12672"]}], "modified": "2019-11-01T02:21:05"}, "score": {"value": 7.1, "vector": "NONE", "modified": "2019-11-01T02:21:05"}, "vulnersScore": 7.1}, "objectVersion": "1.3", "sourceData": "#%NASL_MIN_LEVEL 80502\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-1924. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(44789);\n script_version(\"1.11\");\n script_cvs_date(\"Date: 2019/08/02 13:32:22\");\n\n script_cve_id(\"CVE-2009-3298\", \"CVE-2009-3299\");\n script_xref(name:\"DSA\", value:\"1924\");\n\n script_name(english:\"Debian DSA-1924-1 : mahara - several vulnerabilities\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Two vulnerabilities have been discovered in mahara, an electronic\nportfolio, weblog, and resume builder. The Common Vulnerabilities and\nExposures project identifies the following problems :\n\n - CVE-2009-3298\n Ruslan Kabalin discovered a issue with resetting\n passwords, which could lead to a privilege escalation of\n an institutional administrator account.\n\n - CVE-2009-3299\n Sven Vetsch discovered a cross-site scripting\n vulnerability via the resume fields.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2009-3298\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2009-3299\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2009/dsa-1924\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the mahara packages.\n\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1.0.4-4+lenny4.\n\nThe oldstable distribution (etch) does not contain mahara.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_cwe_id(79, 264);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:mahara\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:5.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/10/31\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/02/24\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"5.0\", prefix:\"mahara\", reference:\"1.0.4-4+lenny4\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"mahara-apache2\", reference:\"1.0.4-4+lenny4\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "naslFamily": "Debian Local Security Checks", "pluginID": "44789", "cpe": ["cpe:/o:debian:debian_linux:5.0", "p-cpe:/a:debian:debian_linux:mahara"], "scheme": null}
{"cve": [{"lastseen": "2019-05-29T18:10:00", "bulletinFamily": "NVD", "description": "Cross-site scripting (XSS) vulnerability in the resume blocktype in Mahara before 1.0.13, and 1.1.x before 1.1.7, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", "modified": "2009-11-16T05:00:00", "id": "CVE-2009-3299", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3299", "published": "2009-11-03T16:30:00", "title": "CVE-2009-3299", "type": "cve", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2019-05-29T18:10:00", "bulletinFamily": "NVD", "description": "Mahara before 1.0.13, and 1.1.x before 1.1.7, allows remote authenticated institution administrators to reset a site administrator password via unspecified vectors.", "modified": "2009-11-04T05:00:00", "id": "CVE-2009-3298", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3298", "published": "2009-11-03T16:30:00", "title": "CVE-2009-3298", "type": "cve", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}], "openvas": [{"lastseen": "2017-07-02T21:14:10", "bulletinFamily": "scanner", "description": "Mahara is prone to a security-bypass vulnerability and to a to a\ncross-site scripting vulnerability.\n\nAn attacker can exploit this issue to reset the application's\nadministrator password or to execute arbitrary script code in the\nbrowser of an unsuspecting user in the context of the affected site.\n\nVersions prior to Mahara 1.0.13 and 1.1.7 are affected.", "modified": "2017-01-10T00:00:00", "published": "2009-11-04T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=100334", "id": "OPENVAS:100334", "title": "Mahara Multiple vulnerabilities", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: mahara_multiple_vuln.nasl 4975 2017-01-10 16:07:01Z teissa $\n#\n# Mahara Multiple vulnerabilities\n#\n# Authors:\n# Michael Meyer\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ntag_summary = \"Mahara is prone to a security-bypass vulnerability and to a to a\ncross-site scripting vulnerability.\n\nAn attacker can exploit this issue to reset the application's\nadministrator password or to execute arbitrary script code in the\nbrowser of an unsuspecting user in the context of the affected site.\n\nVersions prior to Mahara 1.0.13 and 1.1.7 are affected.\";\n\ntag_solution = \"The vendor has released updates. Please see the references for\ndetails.\";\n\nif (description)\n{\n script_id(100334);\n script_version(\"$Revision: 4975 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-01-10 17:07:01 +0100 (Tue, 10 Jan 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-11-04 12:36:10 +0100 (Wed, 04 Nov 2009)\");\n script_bugtraq_id(36893,36892);\n script_cve_id(\"CVE-2009-3298\", \"CVE-2009-3299\");\n script_tag(name:\"cvss_base\", value:\"6.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n\n script_name(\"Mahara Multiple vulnerabilities\");\n\n script_xref(name : \"URL\" , value : \"http://www.securityfocus.com/bid/36893\");\n script_xref(name : \"URL\" , value : \"http://www.securityfocus.com/bid/36892\");\n script_xref(name : \"URL\" , value : \"http://wiki.mahara.org/Release_Notes/1.1.7\");\n script_xref(name : \"URL\" , value : \"http://mahara.org/\");\n script_xref(name : \"URL\" , value : \"http://mahara.org/interaction/forum/topic.php?id=1169\");\n script_xref(name : \"URL\" , value : \"http://mahara.org/interaction/forum/topic.php?id=1170\");\n\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n script_category(ACT_GATHER_INFO);\n script_family(\"Web application abuses\");\n script_copyright(\"This script is Copyright (C) 2009 Greenbone Networks GmbH\");\n script_dependencies(\"secpod_mahara_detect.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_exclude_keys(\"Settings/disable_cgi_scanning\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n exit(0);\n}\n\ninclude(\"http_func.inc\");\ninclude(\"http_keepalive.inc\");\ninclude(\"version_func.inc\");\n\nport = get_http_port(default:80);\nif(!get_port_state(port))exit(0);\n\nif (!can_host_php(port:port)) exit(0);\n\nif(!version = get_kb_item(string(\"www/\", port, \"/Mahara\")))exit(0);\nif(!matches = eregmatch(string:version, pattern:\"^(.+) under (/.*)$\"))exit(0);\n\nvers = matches[1];\n\nif(!isnull(vers) && vers >!< \"unknown\") {\n\n if(version_in_range(version: vers, test_version: \"1.0\", test_version2: \"1.0.12\") ||\n version_in_range(version: vers, test_version: \"1.1\", test_version2: \"1.1.6\")) {\n security_message(port:port);\n exit(0);\n }\n\n}\n\nexit(0);\n", "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-07-24T12:56:24", "bulletinFamily": "scanner", "description": "The remote host is missing an update to mahara\nannounced via advisory DSA 1924-1.", "modified": "2017-07-07T00:00:00", "published": "2009-11-11T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=66204", "id": "OPENVAS:66204", "title": "Debian Security Advisory DSA 1924-1 (mahara)", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_1924_1.nasl 6615 2017-07-07 12:09:52Z cfischer $\n# Description: Auto-generated from advisory DSA 1924-1 (mahara)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Two vulnerabilities have been discovered in, an electronic portfolio,\nweblog, and resume builder. The Common Vulnerabilities and Exposures\nproject identifies the following problems:\n\nCVE-2009-3298\n\nRuslan Kabalin discovered a issue with resetting passwords, which could\nlead to a privilege escalation of an institutional administrator\naccount.\n\nCVE-2009-3299\n\nSven Vetsch discovered a cross-site scripting vulnerability via the\nresume fields.\n\n\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1.0.4-4+lenny4.\n\nThe oldstable distribution (etch) does not contain mahara.\n\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem will be fixed soon.\n\n\nWe recommend that you upgrade your mahara packages.\";\ntag_summary = \"The remote host is missing an update to mahara\nannounced via advisory DSA 1924-1.\";\n\ntag_solution = \"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201924-1\";\n\n\nif(description)\n{\n script_id(66204);\n script_version(\"$Revision: 6615 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 14:09:52 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-11-11 15:56:44 +0100 (Wed, 11 Nov 2009)\");\n script_cve_id(\"CVE-2009-3298\", \"CVE-2009-3299\");\n script_tag(name:\"cvss_base\", value:\"6.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_name(\"Debian Security Advisory DSA 1924-1 (mahara)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"mahara-apache2\", ver:\"1.0.4-4+lenny4\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"mahara\", ver:\"1.0.4-4+lenny4\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-04-06T11:38:13", "bulletinFamily": "scanner", "description": "The remote host is missing an update to mahara\nannounced via advisory DSA 1924-1.", "modified": "2018-04-06T00:00:00", "published": "2009-11-11T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231066204", "id": "OPENVAS:136141256231066204", "type": "openvas", "title": "Debian Security Advisory DSA 1924-1 (mahara)", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_1924_1.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Auto-generated from advisory DSA 1924-1 (mahara)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Two vulnerabilities have been discovered in, an electronic portfolio,\nweblog, and resume builder. The Common Vulnerabilities and Exposures\nproject identifies the following problems:\n\nCVE-2009-3298\n\nRuslan Kabalin discovered a issue with resetting passwords, which could\nlead to a privilege escalation of an institutional administrator\naccount.\n\nCVE-2009-3299\n\nSven Vetsch discovered a cross-site scripting vulnerability via the\nresume fields.\n\n\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1.0.4-4+lenny4.\n\nThe oldstable distribution (etch) does not contain mahara.\n\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem will be fixed soon.\n\n\nWe recommend that you upgrade your mahara packages.\";\ntag_summary = \"The remote host is missing an update to mahara\nannounced via advisory DSA 1924-1.\";\n\ntag_solution = \"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201924-1\";\n\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.66204\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-11-11 15:56:44 +0100 (Wed, 11 Nov 2009)\");\n script_cve_id(\"CVE-2009-3298\", \"CVE-2009-3299\");\n script_tag(name:\"cvss_base\", value:\"6.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_name(\"Debian Security Advisory DSA 1924-1 (mahara)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"mahara-apache2\", ver:\"1.0.4-4+lenny4\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"mahara\", ver:\"1.0.4-4+lenny4\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-05-29T18:40:19", "bulletinFamily": "scanner", "description": "Mahara is prone to a security-bypass vulnerability and to a to a\n cross-site scripting vulnerability.", "modified": "2019-05-13T00:00:00", "published": "2009-11-04T00:00:00", "id": "OPENVAS:1361412562310100334", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310100334", "title": "Mahara Multiple Vulnerabilities", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mahara Multiple Vulnerabilities\n#\n# Authors:\n# Michael Meyer\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif (description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.100334\");\n script_version(\"2019-05-13T14:05:09+0000\");\n script_tag(name:\"last_modification\", value:\"2019-05-13 14:05:09 +0000 (Mon, 13 May 2019)\");\n script_tag(name:\"creation_date\", value:\"2009-11-04 12:36:10 +0100 (Wed, 04 Nov 2009)\");\n script_bugtraq_id(36893, 36892);\n script_cve_id(\"CVE-2009-3298\", \"CVE-2009-3299\");\n script_tag(name:\"cvss_base\", value:\"6.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n\n script_name(\"Mahara Multiple Vulnerabilities\");\n\n script_xref(name:\"URL\", value:\"http://www.securityfocus.com/bid/36893\");\n script_xref(name:\"URL\", value:\"http://www.securityfocus.com/bid/36892\");\n script_xref(name:\"URL\", value:\"http://wiki.mahara.org/Release_Notes/1.1.7\");\n script_xref(name:\"URL\", value:\"http://mahara.org/interaction/forum/topic.php?id=1169\");\n script_xref(name:\"URL\", value:\"http://mahara.org/interaction/forum/topic.php?id=1170\");\n\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n script_category(ACT_GATHER_INFO);\n script_family(\"Web application abuses\");\n script_copyright(\"This script is Copyright (C) 2009 Greenbone Networks GmbH\");\n script_dependencies(\"secpod_mahara_detect.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_mandatory_keys(\"mahara/detected\");\n\n script_tag(name:\"solution\", value:\"The vendor has released updates. Please see the references for\n details.\");\n\n script_tag(name:\"summary\", value:\"Mahara is prone to a security-bypass vulnerability and to a to a\n cross-site scripting vulnerability.\");\n\n script_tag(name:\"impact\", value:\"An attacker can exploit this issue to reset the application's\n administrator password or to execute arbitrary script code in the\n browser of an unsuspecting user in the context of the affected site.\");\n\n script_tag(name:\"affected\", value:\"Versions prior to Mahara 1.0.13 and 1.1.7 are affected.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\ninclude(\"http_func.inc\");\ninclude(\"version_func.inc\");\n\nport = get_http_port(default:80);\nif(!version = get_kb_item(string(\"www/\", port, \"/Mahara\")))exit(0);\nif(!matches = eregmatch(string:version, pattern:\"^(.+) under (/.*)$\"))exit(0);\n\nvers = matches[1];\n\nif(!isnull(vers) && vers >!< \"unknown\") {\n if(version_in_range(version: vers, test_version: \"1.0\", test_version2: \"1.0.12\") ||\n version_in_range(version: vers, test_version: \"1.1\", test_version2: \"1.1.6\")) {\n security_message(port:port, data:\"The target host was found to be vulnerable.\");\n exit(0);\n }\n}\n\nexit(99);\n", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}], "securityvulns": [{"lastseen": "2018-08-31T11:10:32", "bulletinFamily": "software", "description": "-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\n- ------------------------------------------------------------------------\r\nDebian Security Advisory DSA-1924-1 security@debian.org\r\nhttp://www.debian.org/security/ Steffen Joeris\r\nOctober 31, 2009 http://www.debian.org/security/faq\r\n- ------------------------------------------------------------------------\r\n\r\nPackage : mahara\r\nVulnerability : several vulnerabilities\r\nProblem type : remote\r\nDebian-specific: no\r\nCVE IDs : CVE-2009-3298 CVE-2009-3299\r\n\r\nTwo vulnerabilities have been discovered in, an electronic portfolio,\r\nweblog, and resume builder. The Common Vulnerabilities and Exposures\r\nproject identifies the following problems:\r\n\r\nCVE-2009-3298\r\n\r\nRuslan Kabalin discovered a issue with resetting passwords, which could\r\nlead to a privilege escalation of an institutional administrator\r\naccount.\r\n\r\nCVE-2009-3299\r\n\r\nSven Vetsch discovered a cross-site scripting vulnerability via the\r\nresume fields.\r\n\r\n\r\nFor the stable distribution (lenny), these problems have been fixed in\r\nversion 1.0.4-4+lenny4.\r\n\r\nThe oldstable distribution (etch) does not contain mahara.\r\n\r\nFor the testing distribution (squeeze) and the unstable distribution\r\n(sid), this problem will be fixed soon.\r\n\r\n\r\nWe recommend that you upgrade your mahara packages.\r\n\r\n\r\nUpgrade instructions\r\n- --------------------\r\n\r\nwget url\r\n will fetch the file for you\r\ndpkg -i file.deb\r\n will install the referenced file.\r\n\r\nIf you are using the apt-get package manager, use the line for\r\nsources.list as given below:\r\n\r\napt-get update\r\n will update the internal database\r\napt-get upgrade\r\n will install corrected packages\r\n\r\nYou may use an automated update by adding the resources from the\r\nfooter to the proper configuration.\r\n\r\n\r\nDebian GNU/Linux 5.0 alias lenny\r\n- --------------------------------\r\n\r\nDebian (stable)\r\n- ---------------\r\n\r\nStable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.\r\n\r\nSource archives:\r\n\r\n http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+lenny4.dsc\r\n Size/MD5 checksum: 1304 a89de002e60d1435fe9c7375cdd353b3\r\n http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4.orig.tar.gz\r\n Size/MD5 checksum: 2383079 cf1158e4fe3cdba14fb1b71657bf8cc9\r\n http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+lenny4.diff.gz\r\n Size/MD5 checksum: 40473 61fa7821c6637801a3f7a22ed5993233\r\n\r\nArchitecture independent packages:\r\n\r\n http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1.0.4-4+lenny4_all.deb\r\n Size/MD5 checksum: 7908 ce0748a7b83729e5f987529b871f9428\r\n http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+lenny4_all.deb\r\n Size/MD5 checksum: 1637754 cf0bdb218c9fbd5723f1be19ac4b84a6\r\n\r\n\r\n These files will probably be moved into the stable distribution on\r\n its next update.\r\n\r\n- ---------------------------------------------------------------------------------\r\nFor apt-get: deb http://security.debian.org/ stable/updates main\r\nFor dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main\r\nMailing list: debian-security-announce@lists.debian.org\r\nPackage info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1.4.10 (GNU/Linux)\r\n\r\niEYEARECAAYFAkrsvj4ACgkQ62zWxYk/rQdqEgCfYUqtPnoTGmAOhw8j1OZFmdQv\r\n1gAAoJWYH98HT5jkEJsRYSYvrFrNvnB/\r\n=etyf\r\n-----END PGP SIGNATURE-----", "modified": "2009-11-02T00:00:00", "published": "2009-11-02T00:00:00", "id": "SECURITYVULNS:DOC:22726", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:22726", "title": "[SECURITY] [DSA 1924-1] New mahara packages fix several vulnerabilities", "type": "securityvulns", "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-08-31T11:09:34", "bulletinFamily": "software", "description": "PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.", "modified": "2009-11-02T00:00:00", "published": "2009-11-02T00:00:00", "id": "SECURITYVULNS:VULN:10367", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:10367", "title": "Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)", "type": "securityvulns", "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "debian": [{"lastseen": "2019-05-30T02:21:49", "bulletinFamily": "unix", "description": "- ------------------------------------------------------------------------\nDebian Security Advisory DSA-1924-1 security@debian.org\nhttp://www.debian.org/security/ Steffen Joeris\nOctober 31, 2009 http://www.debian.org/security/faq\n- ------------------------------------------------------------------------\n\nPackage : mahara\nVulnerability : several vulnerabilities\nProblem type : remote\nDebian-specific: no\nCVE IDs : CVE-2009-3298 CVE-2009-3299\n\nTwo vulnerabilities have been discovered in, an electronic portfolio,\nweblog, and resume builder. The Common Vulnerabilities and Exposures\nproject identifies the following problems:\n\nCVE-2009-3298\n\nRuslan Kabalin discovered a issue with resetting passwords, which could\nlead to a privilege escalation of an institutional administrator\naccount.\n\nCVE-2009-3299\n\nSven Vetsch discovered a cross-site scripting vulnerability via the\nresume fields.\n\n\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1.0.4-4+lenny4.\n\nThe oldstable distribution (etch) does not contain mahara.\n\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem will be fixed soon.\n\n\nWe recommend that you upgrade your mahara packages.\n\n\nUpgrade instructions\n- --------------------\n\nwget url\n will fetch the file for you\ndpkg -i file.deb\n will install the referenced file.\n\nIf you are using the apt-get package manager, use the line for\nsources.list as given below:\n\napt-get update\n will update the internal database\napt-get upgrade\n will install corrected packages\n\nYou may use an automated update by adding the resources from the\nfooter to the proper configuration.\n\n\nDebian GNU/Linux 5.0 alias lenny\n- --------------------------------\n\nDebian (stable)\n- ---------------\n\nStable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.\n\nSource archives:\n\n http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+lenny4.dsc\n Size/MD5 checksum: 1304 a89de002e60d1435fe9c7375cdd353b3\n http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4.orig.tar.gz\n Size/MD5 checksum: 2383079 cf1158e4fe3cdba14fb1b71657bf8cc9\n http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+lenny4.diff.gz\n Size/MD5 checksum: 40473 61fa7821c6637801a3f7a22ed5993233\n\nArchitecture independent packages:\n\n http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1.0.4-4+lenny4_all.deb\n Size/MD5 checksum: 7908 ce0748a7b83729e5f987529b871f9428\n http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+lenny4_all.deb\n Size/MD5 checksum: 1637754 cf0bdb218c9fbd5723f1be19ac4b84a6\n\n\n These files will probably be moved into the stable distribution on\n its next update.\n\n- ---------------------------------------------------------------------------------\nFor apt-get: deb http://security.debian.org/ stable/updates main\nFor dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main\nMailing list: debian-security-announce@lists.debian.org\nPackage info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>\n", "modified": "2009-11-01T11:08:58", "published": "2009-11-01T11:08:58", "id": "DEBIAN:DSA-1924-1:92909", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2009/msg00247.html", "title": "[SECURITY] [DSA 1924-1] New mahara packages fix several vulnerabilities", "type": "debian", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}], "seebug": [{"lastseen": "2017-11-19T18:31:02", "bulletinFamily": "exploit", "description": "Bugraq ID: 36893\r\nCVE ID\uff1aCVE-2009-3298\r\n\r\nMahara\u662f\u4e00\u6b3e\u5f00\u6e90\u7684\u7535\u5b50\u6587\u4ef6\u5939\uff0c\u7f51\u7edc\u65e5\u5fd7\uff0c\u5c65\u5386\u8868\u751f\u6210\u5668\u548c\u793e\u4f1a\u5316\u7f51\u7edc\u7cfb\u7edf\u3002\r\nMahara\u5b58\u5728\u4e00\u4e2a\u672a\u660e\u7684\u5b89\u5168\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u4ee5\u91cd\u8bbe\u7ad9\u70b9\u7ba1\u7406\u5458\u5bc6\u7801\uff0c\u5bfc\u81f4\u5b8c\u5168\u63a7\u5236\u5e94\u7528\u7cfb\u7edf\u3002\r\n\r\nMahara Mahara 1.1.6 \r\nMahara Mahara 1.1.5 \r\nMahara Mahara 1.1.4 \r\nMahara Mahara 1.1.3 \r\nMahara Mahara 1.1.2 \r\nMahara Mahara 1.1.1 \r\nMahara Mahara 1.0.12 \r\nMahara Mahara 1.0.11 \r\nMahara Mahara 1.0.10 \r\nMahara Mahara 1.0.9 \r\nMahara Mahara 1.0.8 \r\nMahara Mahara 1.0.6 \r\nMahara Mahara 1.0.5 \r\nMahara Mahara 1.0.4 \r\nMahara Mahara 1.0.3 \r\nMahara Mahara 1.0.2 \r\nMahara Mahara 1.0.1\r\n\u7528\u6237\u53ef\u8054\u7cfb\u4f9b\u5e94\u5546\u5347\u7ea7\u5230\u6700\u65b0\u7248\u672c\uff1a\r\nMahara Mahara 1.0.10 \r\nMahara mahara-1.0.13.zip\r\nhttps://eduforge.org/frs/download.php/1053/mahara-1.0.13.zip\r\nMahara Mahara 1.0.11 \r\nMahara mahara-1.0.13.zip\r\nhttps://eduforge.org/frs/download.php/1053/mahara-1.0.13.zip\r\nMahara Mahara 1.0.12 \r\nMahara mahara-1.0.13.zip\r\nhttps://eduforge.org/frs/download.php/1053/mahara-1.0.13.zip\r\nMahara Mahara 1.0.2 \r\nMahara mahara-1.0.13.zip\r\nhttps://eduforge.org/frs/download.php/1053/mahara-1.0.13.zip\r\nMahara Mahara 1.0.3 \r\nMahara mahara-1.0.13.zip\r\nhttps://eduforge.org/frs/download.php/1053/mahara-1.0.13.zip\r\nMahara Mahara 1.0.4 \r\nMahara mahara-1.0.13.zip\r\nhttps://eduforge.org/frs/download.php/1053/mahara-1.0.13.zip\r\nMahara Mahara 1.0.5 \r\nMahara mahara-1.0.13.zip\r\nhttps://eduforge.org/frs/download.php/1053/mahara-1.0.13.zip\r\nMahara Mahara 1.0.6 \r\nMahara mahara-1.0.13.zip\r\nhttps://eduforge.org/frs/download.php/1053/mahara-1.0.13.zip\r\nMahara Mahara 1.0.8 \r\nMahara mahara-1.0.13.zip\r\nhttps://eduforge.org/frs/download.php/1053/mahara-1.0.13.zip\r\nMahara Mahara 1.0.9 \r\nMahara mahara-1.0.13.zip\r\nhttps://eduforge.org/frs/download.php/1053/mahara-1.0.13.zip\r\nMahara Mahara 1.1.1 \r\nMahara mahara-1.1.7.zip\r\nhttps://eduforge.org/frs/download.php/1056/mahara-1.1.7.zip\r\nMahara Mahara 1.1.2 \r\nMahara mahara-1.1.7.zip\r\nhttps://eduforge.org/frs/download.php/1056/mahara-1.1.7.zip\r\nMahara Mahara 1.1.3 \r\nMahara mahara-1.1.7.zip\r\nhttps://eduforge.org/frs/download.php/1056/mahara-1.1.7.zip\r\nMahara Mahara 1.1.4 \r\nMahara mahara-1.1.7.zip\r\nhttps://eduforge.org/frs/download.php/1056/mahara-1.1.7.zip\r\nMahara Mahara 1.1.5 \r\nMahara mahara-1.1.7.zip\r\nhttps://eduforge.org/frs/download.php/1056/mahara-1.1.7.zip\r\nMahara Mahara 1.1.6 \r\nMahara mahara-1.1.7.zip\r\nhttps://eduforge.org/frs/download.php/1056/mahara-1.1.7.zip", "modified": "2009-11-20T00:00:00", "published": "2009-11-20T00:00:00", "href": "https://www.seebug.org/vuldb/ssvid-12672", "id": "SSV:12672", "type": "seebug", "title": "Mahara\u7ba1\u7406\u5bc6\u7801\u91cd\u7f6e\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e", "sourceData": "", "sourceHref": "", "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}