drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Preisgabe von Informationen in Moodle
Name: |
Preisgabe von Informationen in Moodle |
|
ID: |
USN-791-2 |
|
Distribution: |
Ubuntu |
|
Plattformen: |
Ubuntu 9.04 |
|
Datum: |
Mi, 24. Juni 2009, 22:08 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1171 |
|
Applikationen: |
Moodle |
|
Originalnachricht |
--===============6657661827413418913== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="rqzD5py0kzyFAOWN" Content-Disposition: inline
--rqzD5py0kzyFAOWN Content-Type: text/plain; charset=us-ascii Content-Disposition: inline
=========================================================== Ubuntu Security Notice USN-791-2 June 24, 2009 moodle vulnerability CVE-2009-1171 ===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 9.04
This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the following package versions:
Ubuntu 9.04: moodle 1.9.4.dfsg-0ubuntu1.1
After a standard system upgrade you need to access the Moodle instance and accept the database update to clear any invalid cached data.
Details follow:
Christian Eibl discovered that the TeX filter in Moodle allowed any function to be used. An authenticated remote attacker could post a specially crafted TeX formula to execute arbitrary TeX functions, potentially reading any file accessible to the web server user, leading to a loss of privacy. (CVE-2009-1171, MSA-09-0009)
Updated packages for Ubuntu 9.04:
Source archives:
moodle_1.9.4.dfsg-0ubuntu1.1.diff.gz Size/MD5: 37358 a51bee20ca3560c1b390b1e12e42c5f1 moodle_1.9.4.dfsg-0ubuntu1.1.dsc Size/MD5: 1477 a842e53d8330a56f47d09a1c19f78f11 moodle_1.9.4.dfsg.orig.tar.gz Size/MD5: 12969234 6263f780d52114c8d6eced8308b66aa7
Architecture independent packages:
moodle_1.9.4.dfsg-0ubuntu1.1_all.deb Size/MD5: 9663672 12cd163fe02d67cda7f972bb5744e3e1
--rqzD5py0kzyFAOWN Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature Content-Disposition: inline
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux)
iEYEARECAAYFAkpChmUACgkQH/9LqRcGPm2WIQCcDE2X05QHrLaGJaY0tZX6UqaP D78An1aNov2heZOPxGC2//NW2izmEY84 =ayd4 -----END PGP SIGNATURE-----
--rqzD5py0kzyFAOWN--
--===============6657661827413418913== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline
-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
--===============6657661827413418913==--
|
|
|
|