moodle: Cross Site Scripting vulnerability in blog/index.php

Debian Bug report logs - #586280
moodle: Cross Site Scripting vulnerability in blog/index.php

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Victor Martinez <vicm3@janus.ajusco.upn.mx>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: moodle: Cross Site Scripting vulnerability in blog/index.php

Date: Thu, 17 Jun 2010 22:59:48 -0500

[Message part 1 (text/plain, inline)]

Package: moodle
Version: 1.8.2.dfsg-3+lenny3
Severity: grave
Tags: security patch
Justification: user security hole

MSA-10-0011:
Topic: Cross Site Scripting vulnerability in blog/index.php
Severity: Critical
Versions affected: <1.8.13 and <1.9.9
Reported by: Emmanuel Bouillon
Issue no.: MDL-22631
Solution: upgrade to 1.8.13 or 1.9.9
Workaround: apply patch or disable blogs
http://git.moodle.org/gw?p=moodle.git;a=commit;h=1f283c9acdf7b6a5c08b2768d3bf89b1e162d421
http://cvs.moodle.org/moodle/blog/lib.php?r1=1.80.2.20&r2=1.80.2.21

Description:
Some parameters were not being properly cleaned on the blog index page, allowing non-persistent cross-site scripting (XSS) attacks.


-- System Information:
Debian Release: 5.0.4
  APT prefers stable
  APT policy: (990, 'stable')
Architecture: i386 (i686)

Kernel: Linux 2.6.26-1-686 (SMP w/2 CPU cores)
Locale: LANG=en_US, LC_CTYPE= (charmap=ISO-8859-1)
Shell: /bin/sh linked to /bin/bash

Versions of packages moodle depends on:
ii  apache2-mpm-prefor 2.2.9-10+lenny7       Apache HTTP Server - traditional n
ii  debconf [debconf-2 1.5.24                Debian configuration management sy
ii  libapache2-mod-php 5.2.6.dfsg.1-1+lenny8 server-side, HTML-embedded scripti
ii  mimetex            1.50-1+lenny1         LaTeX math expressions to anti-ali
ii  mysql-client-5.0 [ 5.0.51a-24+lenny4     MySQL database client binaries
ii  php5-cli           5.2.6.dfsg.1-1+lenny8 command-line interpreter for the p
ii  php5-curl          5.2.6.dfsg.1-1+lenny8 CURL module for php5
ii  php5-gd            5.2.6.dfsg.1-1+lenny8 GD module for php5
ii  php5-mysql         5.2.6.dfsg.1-1+lenny8 MySQL module for php5
ii  smarty             2.6.20-1.2            Template engine for PHP
ii  ucf                3.0016                Update Configuration File: preserv
ii  wwwconfig-common   0.1.2                 Debian web auto configuration
ii  yui                2.5.0-1               Yahoo User Interface Library
ii  zip                2.32-1                Archiver for .zip files

Versions of packages moodle recommends:
ii  mysql-server-5.0 [ 5.0.51a-24+lenny4     MySQL database server binaries
ii  php5-ldap          5.2.6.dfsg.1-1+lenny8 LDAP module for php5

moodle suggests no packages.

-- debconf-show failed

[blog.patch (text/x-diff, attachment)]

Message #10 received at 586280-close@bugs.debian.org (full text, mbox, reply):

From: Tomasz Muras <nexor1984@gmail.com>

To: 586280-close@bugs.debian.org

Subject: Bug#586280: fixed in moodle 1.9.9-1

Date: Wed, 30 Jun 2010 21:34:44 +0000

Source: moodle
Source-Version: 1.9.9-1

We believe that the bug you reported is fixed in the latest version of
moodle, which is due to be installed in the Debian FTP archive:

moodle_1.9.9-1.debian.tar.gz
  to main/m/moodle/moodle_1.9.9-1.debian.tar.gz
moodle_1.9.9-1.dsc
  to main/m/moodle/moodle_1.9.9-1.dsc
moodle_1.9.9-1_all.deb
  to main/m/moodle/moodle_1.9.9-1_all.deb
moodle_1.9.9.orig.tar.gz
  to main/m/moodle/moodle_1.9.9.orig.tar.gz



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 586280@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Tomasz Muras <nexor1984@gmail.com> (supplier of updated moodle package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Wed, 23 Jun 2010 21:00:39 +0100
Source: moodle
Binary: moodle
Architecture: source all
Version: 1.9.9-1
Distribution: unstable
Urgency: low
Maintainer: Moodle Packaging Team <pkg-moodle-maintainers@lists.alioth.debian.org>
Changed-By: Tomasz Muras <nexor1984@gmail.com>
Description: 
 moodle     - Course Management System for Online Learning
Closes: 585425 586280
Changes: 
 moodle (1.9.9-1) unstable; urgency=low
 .
   * Rewritten debian/rules
   * Removed unnecessary usr/share/moodle/update-notifier
   * New Upstream Version: 1.9.9
   * New upstream fixes CVE-2010-1619 (closes: #585425)
   * New upstream fixes MSA-10-0011 (closes: #586280)
Checksums-Sha1: 
 8e1bd6d6c913f2f1b68e716c0c71a96c578cca35 1337 moodle_1.9.9-1.dsc
 11f85f3b933bdc211c0590d480eccbd426cb9a31 13729451 moodle_1.9.9.orig.tar.gz
 4d644f30819ce64b71e3cb7aa99451c431a3a926 17362 moodle_1.9.9-1.debian.tar.gz
 82720d646c0c24cd86c1755f9999330a7fb3a5a9 10079970 moodle_1.9.9-1_all.deb
Checksums-Sha256: 
 66e4b09dcc5cc8d136a9590bb99d384825717e272845e3560dff900fabe3b76e 1337 moodle_1.9.9-1.dsc
 da8080f4e161bd262d68320e27d0c80dfee1e9eb6eb32995ee3f5afaba3b8433 13729451 moodle_1.9.9.orig.tar.gz
 8f82700f15fe52b2ba723c3e1da6f2d0158da606ca9739575a0080d99d2008ad 17362 moodle_1.9.9-1.debian.tar.gz
 182a73be3c88d69c524c48a1ae08c8cbad1026ec7b895b4b137cd88efe55e62f 10079970 moodle_1.9.9-1_all.deb
Files: 
 64c8aae6b95fd7efa2c5e45df5b24f3d 1337 web optional moodle_1.9.9-1.dsc
 3cf8f4dca5ed48537a44bc67e4636a15 13729451 web optional moodle_1.9.9.orig.tar.gz
 48091e2504a239cf1c6e37f208fffcfb 17362 web optional moodle_1.9.9-1.debian.tar.gz
 a6c149a34237385ea0ebed298dc4a106 10079970 web optional moodle_1.9.9-1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAkwrr0QACgkQpDDGqoi7tR5L0QCgoYCg5Z1F44EaxoUFrF//hl/s
qDcAoMXRKnAJ4Fgo6E4rBX7zAWZdXyIQ
=a+7f
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.