Detections
Analytics
Debian DSA-1691-1 : moodle - several vulnerabilities
critical Nessus Plugin ID 35254
Synopsis
The remote Debian host is missing a security-related update.Description
Several remote vulnerabilities have been discovered in Moodle, an online course management system. The following issues are addressed in this update, ranging from cross site scripting to remote code execution.Various cross site scripting issues in the Moodle codebase (CVE-2008-3326, CVE-2008-3325, CVE-2007-3555, CVE-2008-5432, MSA-08-0021, MDL-8849, MDL-12793, MDL-11414, MDL-14806, MDL-10276).
Various cross site request forgery issues in the Moodle codebase (CVE-2008-3325, MSA-08-0023).
Privilege escalation bugs in the Moodle codebase (MSA-08-0001, MDL-7755).
SQL injection issue in the hotpot module (MSA-08-0010).
An embedded copy of Smarty had several vulnerabilities (CVE-2008-4811, CVE-2008-4810 ). An embedded copy of Snoopy was vulnerable to cross site scripting (CVE-2008-4796 ). An embedded copy of Kses was vulnerable to cross site scripting (CVE-2008-1502 ).
Solution
Upgrade the moodle (1.6.3-2+etch1) package.For the stable distribution (etch), these problems have been fixed in version 1.6.3-2+etch1.
See Also
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=432264
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471158
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=489533
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=492492
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504235
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504345
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508593
https://security-tracker.debian.org/tracker/CVE-2008-3326
https://security-tracker.debian.org/tracker/CVE-2008-3325
https://security-tracker.debian.org/tracker/CVE-2007-3555
https://security-tracker.debian.org/tracker/CVE-2008-5432
https://security-tracker.debian.org/tracker/CVE-2008-4811
https://security-tracker.debian.org/tracker/CVE-2008-4810
https://security-tracker.debian.org/tracker/CVE-2008-4796
Plugin Details
Severity: Critical
ID: 35254
File Name: debian_DSA-1691.nasl
Version: 1.22
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 12/22/2008
Updated: 1/4/2021
Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 8.3
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:moodle, cpe:/o:debian:debian_linux:4.0
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 12/22/2008
Vulnerability Publication Date: 7/4/2007
Exploitable With
CANVAS (D2ExploitPack)
Elliot (Moodle <= 1.8.4 RCE)
Reference Information
CVE: CVE-2007-3555, CVE-2008-1502, CVE-2008-3325, CVE-2008-3326, CVE-2008-4796, CVE-2008-4810, CVE-2008-4811, CVE-2008-5432, CVE-2008-6124, CVE-2008-6125