(Este correo electrónico va a más de 94.000 administradores de Moodle registrados. Te
recibiendo este mensaje porque usted pidió noticias de seguridad Moodle cuando
registrado un sitio Moodle. Si usted no quiere que estos mensajes de correo electrónico a continuación, ver el final
de este correo electrónico para obtener información acerca de darse de baja. Las respuestas a este correo electrónico no será
leer.)
Estoy escribiendo hoy para hacerle saber que Moodle 2.5.3, 2.4.7 y 2.3.10 son
disponible a través de los canales abiertos de descarga habituales ( http://download.moodle.org
o Git).
Tenga en cuenta la rama 2.3 es ahora compatible sólo para las revisiones de seguridad.
Las notas de la versión completa aquí:
http://docs.moodle.org/dev/
http://docs.moodle.org/dev/
http://docs.moodle.org/dev/
La liberación de Moodle 2.6 ha sido retrasado hasta principios de la próxima semana.
CUESTIONES DE SEGURIDAD
Además de una larga lista de correcciones de errores, mejoras de rendimiento y pulir,
hay 5 temas de seguridad que debe tener en cuenta. Los detalles de las opciones de seguridad
problemas se enumeran a continuación.
Como administrador de Moodle registrado que le estamos dando aviso previo de estas cuestiones
así que tienes tiempo para corregirlos antes de que publiquemos más ampliamente en
http://moodle.org/security en una semana.
Para evitar dejar su sitio vulnerable le recomendamos que actualice su
sitios a la última versión de Moodle, tan pronto como sea posible.
Si no se puede actualizar, por favor, consulte la lista siguiente cuidadosamente y patch
su propio sistema o desactivar esas características.
Gracias, como siempre, a todos los involucrados en la presentación de informes y la fijación de la seguridad
cuestiones. Realmente es un esfuerzo de equipo y uno con más y más personas involucradas
todo el tiempo.
Gracias por usar Moodle!
Michael de Raadt
Gerente de Desarrollo, Moodle HQ
==============================
MSA-13-0025: encabezados incorrectos emitidos por los recursos garantizados
Descripción: Algunos archivos se están entregando con correctos
cabeceras lo que significa que podrían ser aguas abajo en caché.
Resumen Edición: encabezados incorrectos emitidos por los recursos garantizados
La gravedad / riesgo: menor
Versiones afectadas: 2.5 a 2.5.2, 2.4 y 2.4.6 a 2.3.9, 2.3 y
versiones no soportadas anteriormente
Versiones fijas: 2.6, 2.5.3, 2.4.7 y 2.3.10
Reportado por Tony Levi
El n °:. MDL-38743, MDL-42686
Identificador CVE: CVE-2013-4522
Los cambios (maestro):
http://git.moodle.org/gw?p=
==============================
MSA-13-0026: Cross Site scripting en Mensajes
Descripción: JavaScript en los mensajes se está ejecutando en algunos
páginas.
Resumen Edición: Cross Site Scripting en Mensajes
La gravedad / riesgo: grave
Versiones afectadas: 2.5 a 2.5.2, 2.4 y 2.4.6 a 2.3.9, 2.3 y
versiones no soportadas anteriormente
Versiones fijas: 2.6, 2.5.3, 2.4.7 y 2.3.10
Reportado por: Panagiotis Petasis
El n °:. MDL-41941
Identificador CVE: CVE-2013-4523
Solución: Desactivar mensajes
Los cambios (maestro):
http://git.moodle.org/gw?p=
==============================
MSA-13-0027: El acceso a los archivos del servidor a través de depósito
Descripción: El repositorio del sistema de archivos estaba permitiendo el acceso
a los archivos más allá de la zona de archivos de Moodle.
Resumen Edición: repositorio del sistema de archivos proporciona acceso de lectura al
sistema de archivo completo
La gravedad / riesgo: grave
Versiones afectadas: 2.5 a 2.5.2, 2.4 y 2.4.6 a 2.3.9, 2.3 y
versiones no soportadas anteriormente
Versiones fijas: 2.6, 2.5.3, 2.4.7 y 2.3.10
Reportado por: Frédéric Massart
El n °:. MDL-41807
Identificador CVE: CVE-2013-4524
Solución: No habilite repositorio del sistema de archivos (por defecto)
Los cambios (maestro):
http://git.moodle.org/gw?p=
==============================
MSA-13-0028: Cross site scripting en el concurso
Descripción: JavaScript en cuestión respuestas se está ejecutando en
la página de resultados de la prueba.
Resumen Edición: XSS en la vista página de resultados de prueba
La gravedad / riesgo: grave
Versiones afectadas: 2.5 a 2.5.2, 2.4 y 2.4.6 a 2.3.9, 2.3 y
versiones no soportadas anteriormente
Versiones fijas: 2.6, 2.5.3, 2.4.7 y 2.3.10
Reportado por: Michael Hess
El n °:. MDL-41820
Identificador CVE: CVE-2013-4525
Solución: Evitar respuestas basadas en texto en Quiz.
Los cambios (maestro):
http://git.moodle.org/gw?p=
==============================
MSA-13-0029: Cross site scripting vulnerabilidad en la biblioteca de YUI
Descripción: archivos Flash distribuidos con la biblioteca de YUI
puede haber permitido a los ataques cross-site scripting.
Esto es adicional a MSA-13-0025.
Resumen Edición: YUI2 vulnerabilidad de seguridad
La gravedad / riesgo: grave
Versiones afectadas: 2.3 a 2.3.9 y versiones anteriores no compatibles
Versiones fijas: 03/02/10
Reportado por: Petr Škoda
El n °:. MDL-42780
Solución: elimine todos los archivos SWF en el directorio lib / yui.
Los cambios (maestro):
http://git.moodle.org/gw?p=
==============================
-
Usted está recibiendo este correo electrónico porque se registró un sitio Moodle con Moodle.org
y eligió para ser añadido a esta lista de bajo volumen de las notificaciones de seguridad y otras
anuncios importantes relacionados con Moodle para los administradores de Moodle.
Para anular su suscripción, puede volver a registrar su sitio (como antes) y asegúrese de que
desactivar la opción de correo electrónico OFF en el formulario de registro. También puede enviar
un mensaje en blanco a sympa@lists.moodle.org con securityalerts "darse de baja"
como el tema (de la dirección de correo electrónico que está suscrito).
Ver http://lists.moodle.org/info/
---------- Forwarded message ----------
Hello registered Moodle Admins!
(This email is going out to over 94,000 registered Moodle admins. You are
receiving this email because you asked for Moodle security news when you
registered a Moodle site. If you don't want these emails then see the very end
of this email for info about unsubscribing. Replies to this email will not be
read.)
I'm writing today to let you know that Moodle 2.5.3, 2.4.7 and 2.3.10 are
available via the usual open download channels (http://download.moodle.org
or Git).
Note the 2.3 branch is now supported for security fixes only.
The full release notes are here:
http://docs.moodle.org/dev/
http://docs.moodle.org/dev/
http://docs.moodle.org/dev/
The release of Moodle 2.6 has been delayed until early next week.
SECURITY ISSUES
As well as a long list of bug fixes, performance improvements and polishing,
there are 5 security issues you should be aware of. Details of these security
issues are listed below.
As a registered Moodle admin we are giving you advance notice of these issues
so you have some time to fix them before we publish them more widely on
http://moodle.org/security in one week.
To avoid leaving your site vulnerable we highly recommend you upgrade your
sites to the latest Moodle version as soon as you can.
If you cannot upgrade, then please check the following list carefully and patch
your own system or switch off those features.
Thanks, as always, to EVERYONE involved in reporting and fixing security
issues. It really is a team effort and one with more and more people involved
all the time.
Thanks for using Moodle!
Michael de Raadt
Development Manager, Moodle HQ
==============================
MSA-13-0025: Incorrect headers emitted for secured resources
Description: Some files were being delivered with incorrect
headers meaning they could be cached downstream.
Issue summary: Incorrect headers emitted for secured resources
Severity/Risk: Minor
Versions affected: 2.5 to 2.5.2, 2.4 to 2.4.6, 2.3 to 2.3.9 and
earlier unsupported versions
Versions fixed: 2.6, 2.5.3, 2.4.7 and 2.3.10
Reported by: Tony Levi
Issue no.: MDL-38743, MDL-42686
CVE Identifier: CVE-2013-4522
Changes (master):
http://git.moodle.org/gw?p=
==============================
MSA-13-0026: Cross site scripting in Messages
Description: JavaScript in messages was being executed on some
pages.
Issue summary: Cross Site Scripting in Messages
Severity/Risk: Serious
Versions affected: 2.5 to 2.5.2, 2.4 to 2.4.6, 2.3 to 2.3.9 and
earlier unsupported versions
Versions fixed: 2.6, 2.5.3, 2.4.7 and 2.3.10
Reported by: Panagiotis Petasis
Issue no.: MDL-41941
CVE Identifier: CVE-2013-4523
Workaround: Disable messages
Changes (master):
http://git.moodle.org/gw?p=
==============================
MSA-13-0027: Access to server files through repository
Description: The file system repository was allowing access
to files beyond the Moodle file area.
Issue summary: File System repository gives read access to the
whole file system
Severity/Risk: Serious
Versions affected: 2.5 to 2.5.2, 2.4 to 2.4.6, 2.3 to 2.3.9 and
earlier unsupported versions
Versions fixed: 2.6, 2.5.3, 2.4.7 and 2.3.10
Reported by: Frédéric Massart
Issue no.: MDL-41807
CVE Identifier: CVE-2013-4524
Workaround: Do not enable File System repository (default)
Changes (master):
http://git.moodle.org/gw?p=
==============================
MSA-13-0028: Cross site scripting in Quiz
Description: JavaScript in question answers was being executed on
the Quiz Results page.
Issue summary: XSS on view quiz results page
Severity/Risk: Serious
Versions affected: 2.5 to 2.5.2, 2.4 to 2.4.6, 2.3 to 2.3.9 and
earlier unsupported versions
Versions fixed: 2.6, 2.5.3, 2.4.7 and 2.3.10
Reported by: Michael Hess
Issue no.: MDL-41820
CVE Identifier: CVE-2013-4525
Workaround: Avoid text-based answers in Quiz.
Changes (master):
http://git.moodle.org/gw?p=
==============================
MSA-13-0029: Cross site scripting vulnerability in YUI library
Description: Flash files distributed with the YUI library
may have allowed for cross-site scripting attacks.
This is additional to MSA-13-0025.
Issue summary: YUI2 security vulnerability
Severity/Risk: Serious
Versions affected: 2.3 to 2.3.9 and earlier unsupported versions
Versions fixed: 2.3.10
Reported by: Petr Škoda
Issue no.: MDL-42780
Workaround: Remove all SWF files under the lib/yui directory.
Changes (master):
http://git.moodle.org/gw?p=
==============================
--
You are receiving this email because you registered a Moodle site with Moodle.org
and chose to be added to this low-volume list of security notifications and other
important Moodle-related announcements for Moodle administrators.
To unsubscribe you can re-register your site (as above) and make sure you
turn the email option OFF in the registration form. You can also send
a blank email to sympa@lists.moodle.org with "unsubscribe securityalerts"
as the subject (from the email address that is subscribed).
See http://lists.moodle.org/info/
Hello registered Moodle Admins!
(This email is going out to over 94,000 registered Moodle admins. You are
receiving this email because you asked for Moodle security news when you
registered a Moodle site. If you don't want these emails then see the very end
of this email for info about unsubscribing. Replies to this email will not be
read.)
I'm writing today to let you know that Moodle 2.5.3, 2.4.7 and 2.3.10 are
available via the usual open download channels (http://download.moodle.org
or Git).
Note the 2.3 branch is now supported for security fixes only.
The full release notes are here:
http://docs.moodle.org/dev/
http://docs.moodle.org/dev/
http://docs.moodle.org/dev/
The release of Moodle 2.6 has been delayed until early next week.
SECURITY ISSUES
As well as a long list of bug fixes, performance improvements and polishing,
there are 5 security issues you should be aware of. Details of these security
issues are listed below.
As a registered Moodle admin we are giving you advance notice of these issues
so you have some time to fix them before we publish them more widely on
http://moodle.org/security in one week.
To avoid leaving your site vulnerable we highly recommend you upgrade your
sites to the latest Moodle version as soon as you can.
If you cannot upgrade, then please check the following list carefully and patch
your own system or switch off those features.
Thanks, as always, to EVERYONE involved in reporting and fixing security
issues. It really is a team effort and one with more and more people involved
all the time.
Thanks for using Moodle!
Michael de Raadt
Development Manager, Moodle HQ
==============================
MSA-13-0025: Incorrect headers emitted for secured resources
Description: Some files were being delivered with incorrect
headers meaning they could be cached downstream.
Issue summary: Incorrect headers emitted for secured resources
Severity/Risk: Minor
Versions affected: 2.5 to 2.5.2, 2.4 to 2.4.6, 2.3 to 2.3.9 and
earlier unsupported versions
Versions fixed: 2.6, 2.5.3, 2.4.7 and 2.3.10
Reported by: Tony Levi
Issue no.: MDL-38743, MDL-42686
CVE Identifier: CVE-2013-4522
Changes (master):
http://git.moodle.org/gw?p=
==============================
MSA-13-0026: Cross site scripting in Messages
Description: JavaScript in messages was being executed on some
pages.
Issue summary: Cross Site Scripting in Messages
Severity/Risk: Serious
Versions affected: 2.5 to 2.5.2, 2.4 to 2.4.6, 2.3 to 2.3.9 and
earlier unsupported versions
Versions fixed: 2.6, 2.5.3, 2.4.7 and 2.3.10
Reported by: Panagiotis Petasis
Issue no.: MDL-41941
CVE Identifier: CVE-2013-4523
Workaround: Disable messages
Changes (master):
http://git.moodle.org/gw?p=
==============================
MSA-13-0027: Access to server files through repository
Description: The file system repository was allowing access
to files beyond the Moodle file area.
Issue summary: File System repository gives read access to the
whole file system
Severity/Risk: Serious
Versions affected: 2.5 to 2.5.2, 2.4 to 2.4.6, 2.3 to 2.3.9 and
earlier unsupported versions
Versions fixed: 2.6, 2.5.3, 2.4.7 and 2.3.10
Reported by: Frédéric Massart
Issue no.: MDL-41807
CVE Identifier: CVE-2013-4524
Workaround: Do not enable File System repository (default)
Changes (master):
http://git.moodle.org/gw?p=
==============================
MSA-13-0028: Cross site scripting in Quiz
Description: JavaScript in question answers was being executed on
the Quiz Results page.
Issue summary: XSS on view quiz results page
Severity/Risk: Serious
Versions affected: 2.5 to 2.5.2, 2.4 to 2.4.6, 2.3 to 2.3.9 and
earlier unsupported versions
Versions fixed: 2.6, 2.5.3, 2.4.7 and 2.3.10
Reported by: Michael Hess
Issue no.: MDL-41820
CVE Identifier: CVE-2013-4525
Workaround: Avoid text-based answers in Quiz.
Changes (master):
http://git.moodle.org/gw?p=
==============================
MSA-13-0029: Cross site scripting vulnerability in YUI library
Description: Flash files distributed with the YUI library
may have allowed for cross-site scripting attacks.
This is additional to MSA-13-0025.
Issue summary: YUI2 security vulnerability
Severity/Risk: Serious
Versions affected: 2.3 to 2.3.9 and earlier unsupported versions
Versions fixed: 2.3.10
Reported by: Petr Škoda
Issue no.: MDL-42780
Workaround: Remove all SWF files under the lib/yui directory.
Changes (master):
http://git.moodle.org/gw?p=
==============================
--
You are receiving this email because you registered a Moodle site with Moodle.org
and chose to be added to this low-volume list of security notifications and other
important Moodle-related announcements for Moodle administrators.
To unsubscribe you can re-register your site (as above) and make sure you
turn the email option OFF in the registration form. You can also send
a blank email to sympa@lists.moodle.org with "unsubscribe securityalerts"
as the subject (from the email address that is subscribed).
See http://lists.moodle.org/info/
No hay comentarios:
Publicar un comentario