Vicm3
2009-Dec-05 06:41 UTC
[Secure-testing-team] Bug#559531: moodle: Security fixes released
Package: moodle
Version: 1.8.2.dfsg-3+lenny2
Severity: grave
Tags: security
Justification: user security hole
A serie of security issues are fixed on 1.8.11, also salted passwords are
enabled for new installations.
http://docs.moodle.org/en/Moodle_1.8.11_release_notes
Security issues
* MSA-09-0022 - Multiple CSRF problems fixed
* MSA-09-0023 - Fixed user account disclosure in LAMS module
* MSA-09-0024 - Fixed insufficient access control in Glossary module
* MSA-09-0025 - Unneeded MD5 hashes removed from user table
* MSA-09-0026 - Fixed invalid application access control in MNET interface
* MSA-09-0027 - Ensured login information is always sent secured when using
SSL for logins
* MSA-09-0028 - Passwords and secrets are no longer ever saved in backups,
new backup capabilities moodle/backup:userinfo and moodle/restore:userinfo for
controlling who can backup/restore user data
* MSA-09-0029 - Enabling a password salt in encouraged in config.php and
admins are forced to change password after the upgrade
* MSA-09-0031 - Fixed SQL injection in SCORM module
-- System Information:
Debian Release: 5.0.3
APT prefers stable
APT policy: (900, ''stable'')
Architecture: i386 (i686)
Kernel: Linux 2.6.26-1-686 (SMP w/2 CPU cores)
Locale: LANG=en_US, LC_CTYPE= (charmap=ISO-8859-1)
Shell: /bin/sh linked to /bin/bash
Versions of packages moodle depends on:
ii apache2-mpm-prefor 2.2.9-10+lenny6 Apache HTTP Server - traditional n
ii debconf [debconf-2 1.5.24 Debian configuration management sy
ii libapache2-mod-php 5.2.6.dfsg.1-1+lenny4 server-side, HTML-embedded scripti
ii mimetex 1.50-1+lenny1 LaTeX math expressions to anti-ali
ii mysql-client-5.0 [ 5.0.51a-24+lenny2 MySQL database client binaries
ii php5-cli 5.2.6.dfsg.1-1+lenny4 command-line interpreter for the p
ii php5-curl 5.2.6.dfsg.1-1+lenny4 CURL module for php5
ii php5-gd 5.2.6.dfsg.1-1+lenny4 GD module for php5
ii php5-mysql 5.2.6.dfsg.1-1+lenny4 MySQL module for php5
ii smarty 2.6.20-1.2 Template engine for PHP
ii ucf 3.0016 Update Configuration File: preserv
ii wwwconfig-common 0.1.2 Debian web auto configuration
ii yui 2.5.0-1 Yahoo User Interface Library
ii zip 2.32-1 Archiver for .zip files
Versions of packages moodle recommends:
ii mysql-server-5.0 [ 5.0.51a-24+lenny2 MySQL database server binaries
ii php5-ldap 5.2.6.dfsg.1-1+lenny4 LDAP module for php5
moodle suggests no packages.
-- debconf-show failed