The OpenNET Project
 
Search (keywords):  SOFT ARTICLES TIPS & TRICKS SECURITY
LINKS NEWS MAN DOCUMENTATION


[USN-791-2] Moodle vulnerability


<< Previous INDEX Search src / Print Next >>
Date: Wed, 24 Jun 2009 13:02:45 -0700
From: Kees Cook <kees@ubuntu.com.>
To: [email protected]
Subject: [USN-791-2] Moodle vulnerability
Message-ID: <20090624200245.GE15770@outflux.net.>
Reply-To: Ubuntu Security <security@ubuntu.com.>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
        protocol="application/pgp-signature"; boundary="rqzD5py0kzyFAOWN"
Content-Disposition: inline
Organization: Ubuntu
X-MIMEDefang-Filter: outflux$Revision: 1.316 $
X-HELO: www.outflux.net
X-Scanned-By: MIMEDefang 2.64 on 10.2.0.1
X-Virus-Scanned: antivirus-gw at tyumen.ru


--rqzD5py0kzyFAOWN
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline


Ubuntu Security Notice USN-791-2 June 24, 2009 moodle vulnerability CVE-2009-1171
A security issue affects the following Ubuntu releases: Ubuntu 9.04 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 9.04: moodle 1.9.4.dfsg-0ubuntu1.1 After a standard system upgrade you need to access the Moodle instance and accept the database update to clear any invalid cached data. Details follow: Christian Eibl discovered that the TeX filter in Moodle allowed any function to be used. An authenticated remote attacker could post a specially crafted TeX formula to execute arbitrary TeX functions, potentially reading any file accessible to the web server user, leading to a loss of privacy. (CVE-2009-1171, MSA-09-0009) Updated packages for Ubuntu 9.04: Source archives: http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.9.4.dfsg-0ubuntu1.1.diff.gz Size/MD5: 37358 a51bee20ca3560c1b390b1e12e42c5f1 http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.9.4.dfsg-0ubuntu1.1.dsc Size/MD5: 1477 a842e53d8330a56f47d09a1c19f78f11 http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.9.4.dfsg.orig.tar.gz Size/MD5: 12969234 6263f780d52114c8d6eced8308b66aa7 Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.9.4.dfsg-0ubuntu1.1_all.deb Size/MD5: 9663672 12cd163fe02d67cda7f972bb5744e3e1 --rqzD5py0kzyFAOWN Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAkpChmUACgkQH/9LqRcGPm2WIQCcDE2X05QHrLaGJaY0tZX6UqaP D78An1aNov2heZOPxGC2//NW2izmEY84 =ayd4 -----END PGP SIGNATURE----- --rqzD5py0kzyFAOWN--

<< Previous INDEX Search src / Print Next >>



Партнёры:
PostgresPro
Inferno Solutions
Hosting by Hoster.ru
Хостинг:

Закладки на сайте
Проследить за страницей
Created 1996-2024 by Maxim Chirkov
Добавить, Поддержать, Вебмастеру