Security Announcements

MSA-09-0021: Error in ADODB OCI8/MSSQL drivers allows SQL injection vulnerability

Petr Škoda (skodak) — Mon, 02 Nov 2009 20:09:00 GMT

by Petr Škoda (skodak).

Topic:	Error in ADODB OCI8/MSSQL drivers allows SQL injection vulnerability
Severity/Risk:	Critical (only servers using Oracle and MS SQL databases)
Versions affected:	<1.9.6
Reported by:	Sam Moffatt
Issue no.:	MDL-19452
Solution:	upgrade to latest weekly build or 1.9.6
Workaround:	none

Description:
Sam Moffatt discovered a potential problem in the way ADODB library is quoting special characters when the database engine is using Sybase style quoting.

MSA-09-0020: Teachers can view students' grades in all courses in the overview report

Petr Škoda (skodak) — Mon, 02 Nov 2009 19:52:58 GMT

by Petr Škoda (skodak).

Topic:	Teachers can view students' grades in all courses in the overview report
Severity/Risk:	Minor
Versions affected:	<1.9.6
Reported by:	Ratana Lim
Issue no.:	MDL-20355
Solution:	upgrade to latest weekly build or 1.9.6
Workaround:	remove the overview report link - see http://docs.moodle.org/en/Simplifying_the_gradebook

Description:
Teachers could view students' grades in all courses, including courses for which they do not have teacher rights, in the overview report.

MSA-09-0019: SQL injection in update_record

Petr Škoda (skodak) — Mon, 02 Nov 2009 19:49:21 GMT

by Petr Škoda (skodak).

Topic:	SQL injection in update_record
Severity/Risk:	Critical
Versions affected:	<1.9.6, <1.8.10, 1.7.x
Reported by:	Georg-Christian Pranschke
Issue no.:	MDL-20309
Solution:	upgrade to latest weekly builds, 1.9.6 or 1.8.10
Workaround:	apply patches: http://cvs.moodle.org/moodle/lib/dmllib.php?r1=1.116.2.32&r2=1.116.2.33 http://cvs.moodle.org/moodle/lib/dmllib.php?r1=1.91.2.23&r2=1.91.2.24

Description:
Georg-Christian Pranschke discovered a serious problem in update_record function. This problem may allow any registered user to exploit several different scripts.

MSA-09-0018: Incorrect escaping when updating first post in a single simple discussion forum type

Petr Škoda (skodak) — Mon, 02 Nov 2009 19:46:04 GMT

by Petr Škoda (skodak).

Topic:	Incorrect escaping when updating first post in a single simple discussion forum type
Severity/Risk:	Minor
Versions affected:	<1.9.6, <1.8.10
Reported by:	Nicola Vitacolonna
Issue no.:	MDL-20555
Solution:	upgrade to latest weekly build or 1.9.6
Workaround:	none

Description:
Nicola Vitacolonna discovered forum introduction is incorrectly escaped when editing the first post of a single simple discussion forum. This can potentially lead to SQL injection attacks by teachers. Students can not exploit this problem.

MSA-09-0017: Upgrade code in 1.9 does not escape tags properly

Petr Škoda (skodak) — Mon, 02 Nov 2009 19:43:46 GMT

by Petr Škoda (skodak).

Topic:	Upgrade code 1.9 does not escape tags properly
Severity/Risk:	Minor
Versions affected:	<1.9.6
Reported by:	Matt Oquist
Issue no.:	MDL-19709
Solution:	do not use 1.9.0-1.9.5 when upgrading from any previous version

Description:
The upgrade code does not properly escape tags properly when upgrading from any version before 1.9.0.

MSA-09-0016: Email not properly escaped on user edit page

Petr Škoda (skodak) — Mon, 02 Nov 2009 19:41:06 GMT

by Petr Škoda (skodak).

Topic:	Email not properly escaped on user edit page
Severity/Risk:	Minor
Versions affected:	<1.9.6
Reported by:	Alan Trick
Issue no.:	MDL-20295
Solution:	upgrade to latest weekly build or 1.9.6
Workaround:	disable email change confirmation (not recommended)

Description:
Alan Trick discovered that the email change confirmation code does not escape the email addresses properly. This problem is marked as minor because the email address is validated and can not contain an arbitrary text.

MSA-09-0015: Customised PhpMyAdmin upgraded to 2.11.9.6

Petr Škoda (skodak) — Wed, 14 Oct 2009 18:12:59 GMT

by Petr Škoda (skodak).

Topic:	Customised PhpMyAdmin upgraded to 2.11.9.6
Severity:	Major
Versions affected:	all
Reported by:	upstream - PMASA-2009-6; CVE-2009-3696 and CVE-2009-3697
Issue no.:	MDL-20553
Solution:	Install latest package from http://moodle.org/mod/data/view.php?d=13&rid=448 or cvs
Workaround:	delete admin/mysql/*

Description:
http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2009-6

MSA-09-0014: mimeTeX vulnerabilities

Petr Škoda (skodak) — Sun, 19 Jul 2009 18:04:10 GMT

by Petr Škoda (skodak).

Topic:	mimeTeX vulnerabilities
Severity/Risk:	Major
Versions affected:	all
Reported by:	upstream - http://www.ocert.org/advisories/ocert-2009-010.html
Issue no.:	MDL-19832, CVE-2009-1382
Solution:	upgrade to latest weekly built, stable CVS, nightly build or copy new mimetex.* executables into any older release
Workaround:	disable tex and algebra filters

Description:
John Forkosh fixed several serious vulnerabilities in mimeTeX binary which is used in Moodle by TeX and Algebra filter. This was rated as "critical" upstream, however the risk is slightly less on Moodle because this filter can be disabled (and is disabled by default). In addition, the vulnerability is only exposed to valid users who have logged in to Moodle.

MSA-09-0013: Customised PhpMyAdmin upgraded to 2.11.9.5

Petr Škoda (skodak) — Wed, 20 May 2009 11:05:17 GMT

by Petr Škoda (skodak).

Topic:	Customised PhpMyAdmin upgraded to 2.11.9.5
Severity:	Major
Versions affected:	all
Reported by:	upstream - PMASA-2009-1, PMASA-2009-2, PMASA-2009-3, PMASA-2009-4
Issue no.:	MDL-19234
Solution:	Install latest package from http://moodle.org/mod/data/view.php?d=13&rid=448 or cvs
Workaround:	delete admin/mysql/*

Description:
http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2009-1
http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2009-2
http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2009-3
http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2009-4

Please note that some of these vulnerabilities may not be exploitable due to our specific integration changes.

MSA-09-0012: SQL injections when importing outcomes

Petr Škoda (skodak) — Wed, 20 May 2009 11:00:40 GMT

by Petr Škoda (skodak).

Topic:	SQL injections when importing outcomes
Severity:	Major
Versions affected:	< 1.9.5
Reported by:	internal review
Issue no.:	MDL-19036
Solution:	upgrade to 1.9.5

Description:
When reviewing the import outcomes code, it was discovered that incorrect coding allowed SQL injections. By default only trusted users are allowed to use this part of gradebook. It can not be exploited by students.