drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Ausführen beliebiger Kommandos in Moodle
Name: |
Ausführen beliebiger Kommandos in Moodle |
|
ID: |
USN-658-1 |
|
Distribution: |
Ubuntu |
|
Plattformen: |
Ubuntu 7.10, Ubuntu 8.04 LTS |
|
Datum: |
Do, 23. Oktober 2008, 23:47 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1502 |
|
Applikationen: |
Moodle |
|
Originalnachricht |
--===============2573040432736524592== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="WfZ7S8PLGjBY9Voh" Content-Disposition: inline
--WfZ7S8PLGjBY9Voh Content-Type: text/plain; charset=us-ascii Content-Disposition: inline
=========================================================== Ubuntu Security Notice USN-658-1 October 23, 2008 moodle vulnerability CVE-2008-1502 ===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 7.10 Ubuntu 8.04 LTS
This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the following package versions:
Ubuntu 7.10: moodle 1.8.2-1ubuntu2.1
Ubuntu 8.04 LTS: moodle 1.8.2-1ubuntu4.1
In general, a standard system upgrade is sufficient to effect the necessary changes.
Details follow:
Lukasz Pilorz discovered that the HTML filtering used in Moodle was not strict enough. A remote attacker could send malicious requests to Moodle and execute arbitrary code as the web server user.
Updated packages for Ubuntu 7.10:
Source archives:
moodle_1.8.2-1ubuntu2.1.diff.gz Size/MD5: 19705 cddd2761b29fe98f6f0686155b299f48 moodle_1.8.2-1ubuntu2.1.dsc Size/MD5: 741 1590c124a2dbff31fa8aee6f5a3add91 moodle_1.8.2.orig.tar.gz Size/MD5: 10157112 4e6afcfd567571af0638533d157f9181
Architecture independent packages:
moodle_1.8.2-1ubuntu2.1_all.deb Size/MD5: 9294484 c7ec1ead92a220103ea5ca5b439718bb
Updated packages for Ubuntu 8.04 LTS:
Source archives:
moodle_1.8.2-1ubuntu4.1.diff.gz Size/MD5: 19903 31e6f4b817f844d93c4704cdfa70caf0 moodle_1.8.2-1ubuntu4.1.dsc Size/MD5: 741 7968ef24932d8eae67263dc57985050c moodle_1.8.2.orig.tar.gz Size/MD5: 10157112 4e6afcfd567571af0638533d157f9181
Architecture independent packages:
moodle_1.8.2-1ubuntu4.1_all.deb Size/MD5: 9294736 536da637d3f4f399a467a077575660e4
--WfZ7S8PLGjBY9Voh Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature Content-Disposition: inline
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Kees Cook <kees@outflux.net>
iEYEARECAAYFAkkA8CYACgkQH/9LqRcGPm3FEQCaAvtvj6eV7KYKo/CwxU2NYM+B 410AnjS0xzWGaqJ4n/923haJZ+ESnlQE =unvh -----END PGP SIGNATURE-----
--WfZ7S8PLGjBY9Voh--
--===============2573040432736524592== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline
-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
--===============2573040432736524592==--
|
|
|
|