Professional OVAL Repository
[Eng]
[Rus]
[Sign-In]
OVAL
Search
Categories
RedCheck
About
OVAL Definitions
OVAL Items
FSTEC Data Bank Information Security Threats
NKCKI
EOL (End Of Life)
Linux Security Advisories
Mozilla Foundation Security Advisory
IBM
VMware
Cisco
Check Point Software Technologies
Apache
Solaris
FreeBSD
Development
GitHub Enterprise
Google Chrome Security Advisories
Oracle Security Advisories
Adobe Security Advisories
OpenSSL Security Advisories
Microsoft
CVE
CWE
CPE
Latest Updates
OS ROSA
ALT Linux
Astra Linux
RED OS
DSA (Debian Security Advisory) Patсh Statistics
DSA (Debian Security Advisory) Patсh Feed
DSA (Debian Security Advisory) Vulnerability Feed
DLA (Debian Security Advisory) Patсh Statistics
DLA (Debian Security Advisory) Patсh Feed
DLA (Debian Security Advisory) Vulnerability Feed
ALT Linux (Security Bulletins) Patсh Statistics
ALT Linux (Security Bulletins) Patсh Feed
ALT Linux (Security Bulletins) Vulnerability Feed
RED OS (Security Bulletins) Patсh Statistics
RED OS (Security Bulletins) Patсh Feed
RED OS (Security Bulletins) Vulnerability Feed
USN (Ubuntu Security Notice) Patсh Statistics
USN (Ubuntu Security Notice) Patсh Feed
USN (Ubuntu Security Notice) Vulnerability Feed
RHSA (RedHat Security Advisory) Patсh Statistics
RHSA (RedHat Security Advisory) Patсh Feed
RHSA (RedHat Security Advisory) Vulnerability Feed
ELSA (Oracle Linux Security Advisory) Patсh Statistics
ELSA (Oracle Linux Security Advisory) Patсh Feed
ELSA (Oracle Linux Security Advisory) Vulnerability Feed
SUSE (SUSE Security Advisories) Patсh Statistics
SUSE (SUSE Security Advisories) Patсh Feed
SUSE (SUSE Security Advisories) Vulnerability Feed
openSUSE (openSUSE Security Advisories) Patсh Statistics
openSUSE (openSUSE Security Advisories) Patсh Feed
openSUSE (openSUSE Security Advisories) Vulnerability Feed
Amazon Linux AMI (Security Bulletins) Patсh Statistics
Amazon Linux AMI (Security Bulletins) Patсh Feed
Amazon Linux AMI (Security Bulletins) Vulnerability Feed
Mageia Linux (Security Bulletins) Patсh Statistics
Mageia Linux (Security Bulletins) Patсh Feed
Mageia Linux (Security Bulletins) Vulnerability Feed
OS ROSA SX COBALT 1.0
OS ROSA DX COBALT 1.0
ROSA 7.3 (Security Advisories) Patсh Statistics
ROSA 7.3 (Security Advisories) Patсh Feed
ROSA 7.3 (Security Advisories) Vulnerability Feed
ALT Linux SPT 6.0
ALT Linux SPT 7.0
ALT 8 SP
ALT 9
Astra Linux SE 1.5
Astra Linux SE 1.6
Astra Linux SE 1.7
Astra Linux SE 1.8
RED OS Murom 7.1
RED OS Murom 7.2
IBM DB2
VMware Vulnerabilities Advisory (VMSA)
VMware vCenter Patch Advisories
VMware ESXi Patch Advisories
VMware NSX Patches
VMware NSX Vulnerabilities
VMware Photon OS 1.0 Patches
VMware Photon OS 1.0 Vulnerabilities
VMware Photon OS 2.0 Patches
VMware Photon OS 2.0 Vulnerabilities
Cisco ASA
Cisco IOS/NX-OS Advisory
Cisco NX-OS Vulnerabilities
Check Point Gaia
Apache Tomcat Advisories
Apache Tomcat Server
Apache HTTP Server
Python
Node.js
RubyGems
Qt
Microsoft Security Bulletin
Microsoft Knowledge Base Article
Microsoft SharePoint
Microsoft SharePoint Foundation 2013
Microsoft SharePoint Server 2013
Microsoft SharePoint Server 2016
About OVALdb
User manual
Pricing
Contact us
OVAL Definitions
>
OVAL Definition Details
Id
oval:com.altx-soft.nix:def:15119
[Rus]
Version
7
Class
patch
ALTXid
29871
Language
English
Severity
NotAvailable
Title
DSA-2421-1 moodle -- several
Description
Several security issues have been fixed in Moodle, a course management system for online learning: CVE-2011-4308 / CVE-2012-0792 Rossiani Wijaya discovered an information leak in mod/forum/user.php CVE-2011-4584 MNET authentication didn't prevent a user using "Login As" from jumping to a remove MNET SSO. CVE-2011-4585 Darragh Enright discovered that the change password form was send in over plain HTTP even if httpslogin was set to "true". CVE-2011-4586 David Michael Evans and German Sanchez Gances discovered CRLF injection/HTTP response splitting vulnerabilities in the Calendar module. CVE-2011-4587 Stephen Mc Guiness discovered empty passwords could be entered in some circumstances. CVE-2011-4588 Patrick McNeill that IP address restrictions could be bypassed in MNET. CVE-2012-0796 Simon Coggins discovered that additional information could be injected into mail headers. CVE-2012-0795 John Ehringer discovered that email adresses were insufficiently validated. CVE-2012-0794 Rajesh Taneja discovered that cookie encryption used a fixed key. CVE-2012-0793 Eloy Lafuente discovered that profile images were insufficiently protected. A new configuration option "forceloginforprofileimages" was introduced for that.
Family
unix
Platform
Debian GNU/kFreeBSD 6.0
Debian GNU/Linux 6.0
Product
moodle
Reference
VENDOR: DSA-2421-1
VENDOR: DSA-2421-1
Id:
DSA-2421-1
Reference:
http://lists.debian.org/debian-security-announce/2012/msg00049.html
CVE: CVE-2011-4308
CVE: CVE-2011-4308
Id:
CVE-2011-4308
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4308
Comment
: mod/forum/user.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 allows remote authenticated users to discover the names of other users via unspecified vectors.
CVSSv2 Score:
4
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
SINGLE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:S/C:P/I:N/A:N
CWE:
264 (Permissions, Privileges, and Access Controls)
References:
https://bugzilla.redhat.com/show_bug.cgi?id=747444 (CONFIRM)
http://git.moodle.org/gw?p=moodle.git&a=search&s=MDL-28615 (CONFIRM)
http://moodle.org/mod/forum/discuss.php?d=188322 (CONFIRM)
DSA-2421 (DEBIAN)
CVE: CVE-2011-4584
CVE: CVE-2011-4584
Id:
CVE-2011-4584
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4584
Comment
: The MNET authentication functionality in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 allows remote authenticated users to impersonate other user accounts by using the Login As feature in conjunction with a remote MNET single sign-on capability, as demonstrated by a Mahara site.
CVSSv2 Score:
4
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
SINGLE
Confidentiality impact:
NONE
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:S/C:N/I:P/A:N
CWE:
264 (Permissions, Privileges, and Access Controls)
References:
http://moodle.org/mod/forum/discuss.php?d=191751 (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=761248 (CONFIRM)
DSA-2421 (DEBIAN)
http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=10df8657c1c138c0d0ab1d4796c552fcec0c299b (MISC)
CVE: CVE-2011-4585
CVE: CVE-2011-4585
Id:
CVE-2011-4585
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4585
Comment
: login/change_password.php in Moodle 1.9.x before 1.9.15 does not use https for the change-password form even if the httpslogin option is enabled, which allows remote attackers to obtain credentials by sniffing the network.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE:
16 (Configuration)
References:
http://moodle.org/mod/forum/discuss.php?d=191752 (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=761248 (CONFIRM)
DSA-2421 (DEBIAN)
http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=01dd64a8c8aa95f793accea371b2392e662663c5 (MISC)
CVE: CVE-2011-4586
CVE: CVE-2011-4586
Id:
CVE-2011-4586
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4586
Comment
: CRLF injection vulnerability in calendar/set.php in the Calendar subsystem in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:P/A:N
CWE:
CWE-Other ()
References:
https://bugzilla.redhat.com/show_bug.cgi?id=761248 (CONFIRM)
http://moodle.org/mod/forum/discuss.php?d=191754 (CONFIRM)
DSA-2421 (DEBIAN)
http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=581e8dba387f090d89382115fd850d8b44351526 (MISC)
CVE: CVE-2011-4587
CVE: CVE-2011-4587
Id:
CVE-2011-4587
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4587
Comment
: lib/moodlelib.php in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 does not properly handle certain zero values in the password policy, which makes it easier for remote attackers to obtain access by leveraging the possible existence of user accounts that have unchangeable blank passwords.
CVSSv2 Score:
6.8
Access vector:
NETWORK
Access complexity:
MEDIUM
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE:
255 (Credentials Management)
References:
http://moodle.org/mod/forum/discuss.php?d=191755 (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=761248 (CONFIRM)
DSA-2421 (DEBIAN)
http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=e079e82c087becf06d902089d14f3f76686bde19 (MISC)
CVE: CVE-2011-4588
CVE: CVE-2011-4588
Id:
CVE-2011-4588
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4588
Comment
: The ip_in_range function in mnet/lib.php in MNET in Moodle 1.9.x before 1.9.15 uses an incorrect data type, which allows remote attackers to bypass intended IP address restrictions via an XMLRPC request.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
NONE
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:N/I:P/A:N
CWE:
264 (Permissions, Privileges, and Access Controls)
References:
https://bugzilla.redhat.com/show_bug.cgi?id=761248 (CONFIRM)
http://moodle.org/mod/forum/discuss.php?d=191756 (CONFIRM)
DSA-2421 (DEBIAN)
http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=3ab2851d2a59721445945d0706c58092e07e861e (MISC)
CVE: CVE-2012-0792
CVE: CVE-2012-0792
Id:
CVE-2012-0792
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0792
Comment
: mod/forum/user.php in Moodle 1.9.x before 1.9.16 allows remote authenticated users to obtain the names and other details of arbitrary user accounts by searching for posts.
CVSSv2 Score:
4
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
SINGLE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:S/C:P/I:N/A:N
CWE:
200 (Information Exposure)
References:
https://bugzilla.redhat.com/show_bug.cgi?id=783532 (CONFIRM)
http://moodle.org/mod/forum/discuss.php?d=194009 (CONFIRM)
DSA-2421 (DEBIAN)
http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=36b0ddeed45d0751508dcd9fa50f17fda43bae54 (MISC)
CVE: CVE-2012-0793
CVE: CVE-2012-0793
Id:
CVE-2012-0793
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0793
Comment
: Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 allows remote attackers to view the profile images of arbitrary user accounts via unspecified vectors.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE:
264 (Permissions, Privileges, and Access Controls)
References:
https://bugzilla.redhat.com/show_bug.cgi?id=783532 (CONFIRM)
http://moodle.org/mod/forum/discuss.php?d=194012 (CONFIRM)
DSA-2421 (DEBIAN)
http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=90911c4ff98dc2078a3acef5ddf5a1a8f7e20ba5 (MISC)
CVE: CVE-2012-0794
CVE: CVE-2012-0794
Id:
CVE-2012-0794
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0794
Comment
: The rc4encrypt function in lib/moodlelib.php in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 uses a hardcoded password of nfgjeingjk, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by reading this script's source code within the open-source software distribution.
CVSSv2 Score:
5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
NONE
Confidentiality impact:
PARTIAL
Integrity impact:
NONE
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE:
255 (Credentials Management)
References:
https://bugzilla.redhat.com/show_bug.cgi?id=783532 (CONFIRM)
http://moodle.org/mod/forum/discuss.php?d=194013 (CONFIRM)
DSA-2421 (DEBIAN)
http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=98456628a24bba25d336860d38a45b5a4e3895da (MISC)
CVE: CVE-2012-0795
CVE: CVE-2012-0795
Id:
CVE-2012-0795
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0795
Comment
: Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 does not validate e-mail address settings, which allows remote authenticated users to have an unspecified impact via a crafted address.
CVSSv2 Score:
6.5
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
SINGLE
Confidentiality impact:
PARTIAL
Integrity impact:
PARTIAL
Availability impact:
PARTIAL
CVSSv2 Vector:
AV:N/AC:L/Au:S/C:P/I:P/A:P
CWE:
20 (Improper Input Validation)
References:
http://moodle.org/mod/forum/discuss.php?d=194014 (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=783532 (CONFIRM)
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-13572 (CONFIRM)
DSA-2421 (DEBIAN)
CVE: CVE-2012-0796
CVE: CVE-2012-0796
Id:
CVE-2012-0796
Reference:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0796
Comment
: class.phpmailer.php in the PHPMailer library, as used in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 and other products, allows remote authenticated users to inject arbitrary e-mail headers via vectors involving a crafted (1) From: or (2) Sender: header.
CVSSv2 Score:
4
Access vector:
NETWORK
Access complexity:
LOW
Authentication:
SINGLE
Confidentiality impact:
NONE
Integrity impact:
PARTIAL
Availability impact:
NONE
CVSSv2 Vector:
AV:N/AC:L/Au:S/C:N/I:P/A:N
CWE:
94 (Improper Control of Generation of Code ('Code Injection'))
References:
http://moodle.org/mod/forum/discuss.php?d=194015 (CONFIRM)
https://bugzilla.redhat.com/show_bug.cgi?id=783532 (CONFIRM)
DSA-2421 (DEBIAN)
http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=62988bf0bbc73df655f51884aaf1f523928abff9 (MISC)
Content available only for registered users!
ovaldb@altx-soft.com