Bug 761248 (CVE-2011-4581, CVE-2011-4582, CVE-2011-4583, CVE-2011-4584, CVE-2011-4585, CVE-2011-4586, CVE-2011-4587, CVE-2011-4588, CVE-2011-4589, CVE-2011-4590, CVE-2011-4591, CVE-2011-4592, CVE-2011-4593)

Summary:	moodle: multiple security fixes in 2.1.3, 2.0.6, and 1.9.15
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	gwync
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-01-20 18:32:20 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:	761249, 761250
Bug Blocks:

Description Vincent Danen 2011-12-07 22:11:07 UTC

A number of flaws have been fixed in new upstream Moodle 2.1.3 [1], 2.0.6 [2], and 1.9.15 [3] releases.  These do not have CVEs assigned (request pending), and since Fedora/EPEL will rebase to the latest versions of each branch, I'm summarizing them all here rather than creating a number of separate bugs.

[1] http://docs.moodle.org/dev/Moodle_2.1.3_release_notes
[2] http://docs.moodle.org/dev/Moodle_2.0.6_release_notes
[3] http://docs.moodle.org/dev/Moodle_1.9.15_release_notes


MSA-11-0042: Information leak in Wiki
Affects: 2.1.x, 2.0.x 
Fix: http://git.moodle.org/gw?p=moodle.git;a=commit;h=140af2a0f0a4598bf568b9ae182cb81eb583edeb 
Reference: http://moodle.org/mod/forum/discuss.php?d=191747


MSA-11-0043: Possible link redirect in Calendar
Affects: 2.1.x
Fix: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-28720&sr=1
Reference: http://moodle.org/mod/forum/discuss.php?d=191748


MSA-11-0044: Expired identification information shown in Web services
Affects: 2.1.x, 2.0.x
Fix: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-28670&sr=1
Reference: http://moodle.org/mod/forum/discuss.php?d=191750


MSA-11-0045: Potential to masquerade through MNet 
Affects: 2.1.x, 2.0.x, 1.9.x
Fix: http://git.moodle.org/gw?p=moodle.git;a=commitdiff;h=10df8657c1c138c0d0ab1d4796c552fcec0c299b
Reference: http://moodle.org/mod/forum/discuss.php?d=191751


MSA-11-0046: Insecure authentication transmission
Affects: 1.9.x
Fix: http://git.moodle.org/gw?p=moodle.git;a=commitdiff;h=01dd64a8c8aa95f793accea371b2392e662663c5
Reference: http://moodle.org/mod/forum/discuss.php?d=191752


MSA-11-0047: Possible injection attack in Calendar
Affects: 2.1.x, 2.0.x, 1.9.x
Fix: http://git.moodle.org/gw?p=moodle.git;a=commitdiff;h=581e8dba387f090d89382115fd850d8b44351526
Reference: moodle.org/mod/forum/discuss.php?d=191754


MSA-11-0048: Password loss issue
Affects: 2.1.x, 2.0.x, 1.9.x
Fix: http://git.moodle.org/gw?p=moodle.git;a=commitdiff;h=e079e82c087becf06d902089d14f3f76686bde19
Reference: http://moodle.org/mod/forum/discuss.php?d=191755


MSA-11-0049: Network restriction ineffective with MNet
Affects: 1.9.x
Fix: http://git.moodle.org/gw?p=moodle.git;a=commitdiff;h=3ab2851d2a59721445945d0706c58092e07e861e
Reference: http://moodle.org/mod/forum/discuss.php?d=191756


MSA-11-0050: Backup capability issue
Affects: 2.1.x, 2.0.x
Fix: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-29591
Reference: http://moodle.org/mod/forum/discuss.php?d=191758


MSA-11-0051: Authentication issue with Web services
Affects: 2.1.x, 2.0.x
Fix: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-28629
Reference: http://moodle.org/mod/forum/discuss.php?d=191759


MSA-11-0052: Potential to exploit developer debugging scripts
Affects: 2.1.x, 2.0.x
Fix: http://git.moodle.org/gw?p=moodle.git;a=commit;h=187672608ec96659e07f2461b3b83634debd16cb
Reference: http://moodle.org/mod/forum/discuss.php?d=191760


MSA-11-0053: Security and system administration conflict
Affects: 2.1.x, 2.0.x
Fix: http://git.moodle.org/gw?p=moodle.git;a=commit;h=ade30ad3c420ce035a3d68287db701b70e806b3f
Refrence: http://moodle.org/mod/forum/discuss.php?d=191761


MSA-11-0054: Personal information leak
Affects: 2.1.x, 2.0.x
Fix: http://git.moodle.org/gw?p=moodle.git;a=commit;h=e94113a859015a4a80b9397957b8fc4044e2951f
Reference: http://moodle.org/mod/forum/discuss.php?d=191762

Comment 1 Vincent Danen 2011-12-07 22:14:14 UTC

Created moodle tracking bugs for this issue

Affects: fedora-all [bug 761249]
Affects: epel-all [bug 761250]

Comment 2 Vincent Danen 2011-12-07 23:21:33 UTC

The following CVE names were assigned to these flaws:

CVE-2011-4581: MSA-11-0042: Information leak in Wiki

CVE-2011-4582: MSA-11-0043: Possible link redirect in Calendar

CVE-2011-4583: MSA-11-0044: Expired identification information shown in Web services

CVE-2011-4584: MSA-11-0045: Potential to masquerade through MNet 

CVE-2011-4585: MSA-11-0046: Insecure authentication transmission

CVE-2011-4586: MSA-11-0047: Possible injection attack in Calendar

CVE-2011-4587: MSA-11-0048: Password loss issue

CVE-2011-4588: MSA-11-0049: Network restriction ineffective with MNet

CVE-2011-4589: MSA-11-0050: Backup capability issue

CVE-2011-4590: MSA-11-0051: Authentication issue with Web services

CVE-2011-4591: MSA-11-0052: Potential to exploit developer debugging scripts

CVE-2011-4592: MSA-11-0053: Security and system administration conflict

CVE-2011-4593: MSA-11-0054: Personal information leak