(Este correo electrónico está saliendo a más de 84.000 administradores de Moodle registrados. Usted
está recibiendo este correo electrónico porque usted pidió Moodle seguridad noticia
cuando se registró un sitio Moodle. Si usted no quiere que estos mensajes de correo electrónico
a continuación, ver el final de este correo electrónico para obtener información acerca de la suscripción.
Las respuestas a este correo electrónico no será leído.)
Estoy escribiendo hoy para hacerle saber que Moodle 2.3.2, 2.2.5 y 2.1.8
están disponibles a través de los canales habituales de descarga abierta
( http://download.moodle.org , CVS o Git).
Tenga en cuenta que los 2,1 y 1,9 ramas son ahora soportados para la seguridad
sólo las correcciones. También tenga en cuenta que no hay liberación se ha hecho en la rama 1.9
como no ha habido problemas de seguridad graves en esta rama.
Las notas de la versión completa se encuentra aquí:
* http://docs.moodle.org/dev/
* http://docs.moodle.org/dev/
* http://docs.moodle.org/dev/
CUESTIONES DE SEGURIDAD
Además de una larga lista de correcciones de errores, mejoras de rendimiento y
pulido, hay 6 temas de seguridad que debe tener en cuenta.
Los detalles de estos problemas de seguridad se enumeran a continuación.
Como administrador de Moodle registrado le estamos dando aviso previo de estos
cuestiones para que tenga tiempo para corregirlos antes de que ellos publican más
ampliamente en http://moodle.org/security y difundirlos en una semana.
Para evitar dejar su sitio vulnerable le recomendamos que actualice
tus sitios a la última versión de Moodle, tan pronto como sea posible.
Si no se puede actualizar, por favor, compruebe la lista siguiente cuidadosamente
y parchear su propio sistema o apagar esas características.
Gracias, como siempre, a todos los involucrados en la denuncia y la fijación de la seguridad
cuestiones por todo su trabajo duro. Realmente es un esfuerzo de equipo y un
con más y más involucrado en todo momento.
Saludos y gracias por usar Moodle!
Michael de Raadt
Gerente de Desarrollo de Moodle HQ
==============================
MSA-12-0051: Tamaño carga asunto restricción
Tema: / repositorio / repository_ajax.php permite proporcionar
-1 Para "MaxBytes" y paso lateral tamaño de archivo moodle
restricciones
Gravedad / riesgo: menor
Versiones afectadas: 2,3 a + 2.3.1, 2.2 a 2.2.3 +
Reportado por: Andrew Davis
El n °:. MDL-30792
Identificador CVE: CVE-2012-4400
Los cambios (maestro):
http://git.moodle.org/gw?p=
Descripción:
Era posible que un usuario para manipular los parámetros de script para cargar un
archivo de más de los límites establecidos.
==============================
MSA-12-0052: Curso problema de permisos temas
Tema: Problemas de permisos en formato tema del curso
Gravedad / riesgo: menor
Versiones afectadas: 2,3 a + 2.3.1, 2.2 a 2.2.3 +
Reportado por: Alejandro Blas
El n °:. MDL-28207
Identificador CVE: 2012-4401
Los cambios (maestro):
http://git.moodle.org/gw?p=
Descripción:
Los usuarios con capacidades de edición de curso, pero sin permiso para
mostrar / ocultar los temas y definir el tema de actualidad fueron capaces de completar
estas acciones bajo ciertas condiciones.
==============================
MSA-12-0053: archivo de acceso Blog cuestión
Tema: "publishstate '===' público '
Gravedad / riesgo: menor
Versiones afectadas: 2,3 a + 2.3.1, 2.2 a 2.2.3 +, 2.1 a 2.1.6 +
Reportado por: Kyle Decot
El n °:. MDL-34585
Identificador CVE: CVE-2012-4407
Los cambios (maestro):
http://git.moodle.org/gw?p=
Descripción:
Los archivos incrustados como parte de un blog se está entregando sin comprobar
el estado de publicación correctamente.
==============================
MSA-12-0054: Curso de reinicio permiso cuestión
Tema: reset del curso no están protegidos por la capacidad adecuada
Gravedad / riesgo: menor
Versiones afectadas: 2,3 a + 2.3.1, 2.2 a 2.2.3 +, 2.1 a 2.1.6 +
Reportado por: Rex Lorenzo
El n °:. MDL-34519
Identificador CVE: CVE-2012-4408
Los cambios (maestro):
http://git.moodle.org/gw?p=
Descripción:
El enlace de restablecimiento de curso estaba protegida por un permiso correcto, pero el
restablecer propia página se está comprobando si un permiso diferente.
==============================
MSA-12-0055: servicio web de acceso cuestión simbólica
Tema: Un servicio web muestra permite al usuario ejecutar las funciones
de cualquier servicio exterior, no sólo las relacionadas con
el servicio exterior de la prenda es para
Gravedad / riesgo: Serios
Versiones afectadas: 2,3 a + 2.3.1, 2.2 a 2.2.3 +, 2.1 a 2.1.6 +
Reportado por: Nathan Mares
El n °:. MDL-34368
Identificador CVE: CVE-2012-4402
Los cambios (maestro):
http://git.moodle.org/gw?p=
Descripción:
Los usuarios con permiso de acceso a múltiples servicios fueron capaces de utilizar un
señal de un servicio a acceder a otro.
==============================
MSA-12-0056: fuga de información en función de arrastrar y soltar
Tema: Información divulgación en yui_combo.php
Gravedad / riesgo: menor
Versiones afectadas: 2,3 a 2.3.1 +
Reportado por: Mark Baseggio
El n °:. MDL-35168
Identificador CVE: CVE-2012-4403
Los cambios (maestro):
http://git.moodle.org/gw?p=
Descripción:
La secuencia de comandos de arrastrar y soltar estaba respondiendo a las solicitudes con malas
información que incluye la ruta completa a los scripts en el servidor.
-
Usted está recibiendo este correo electrónico porque se registró un sitio Moodle con Moodle.org
y optó por añadir a esta lista de bajo volumen de las notificaciones de seguridad y otros
importantes relacionados con Moodle anuncios para los administradores de Moodle.
Para anular su suscripción, puede volver a registrar su sitio (como antes) y asegúrese de que
activar la opción de correo electrónico cuando esté en el formulario de inscripción. También puede enviar
un mensaje en blanco a sympa@lists.moodle.org con "darse de baja" securityalerts
como el sujeto (la dirección de correo electrónico que está suscrito).
Ver http://lists.moodle.org/info/
---------- Forwarded message ----------
From: <michaeld@moodle.com>
Date: 2012/9/10
Subject: [securityalerts] URGENT: Moodle 2.3.2, 2.2.5 and 2.1.8 are now available
To: securityalerts@lists.moodle.
Hello registered Moodle Admins!
(This email is going out to over 84,000 registered Moodle admins. You
are receiving this email because you asked for Moodle security news
when you registered a Moodle site. If you don't want these emails
then see the very end of this email for info about unsubscribing.
Replies to this email will not be read.)
I'm writing today to let you know that Moodle 2.3.2, 2.2.5 and 2.1.8
are available via the usual open download channels
(http://download.moodle.org, CVS or Git).
Note that the 2.1 and 1.9 branches are now supported for security
fixes only. Also note that no release has been made in the 1.9 branch
as there have been no serious security issues in this branch.
The full release notes are here:
* http://docs.moodle.org/dev/
* http://docs.moodle.org/dev/
* http://docs.moodle.org/dev/
SECURITY ISSUES
As well as a long list of bug fixes, performance improvements and
polishing, there are 6 security issues you should be aware of.
Details of these security issues are listed below.
As a registered Moodle admin we are giving you advance notice of these
issues so you have some time to fix them before we publish them more
widely on http://moodle.org/security and publicise them in one week.
To avoid leaving your site vulnerable we highly recommend you upgrade
your sites to the latest Moodle version as soon as you can.
If you cannot upgrade then please check the following list carefully
and patch your own system or switch off those features.
Thanks, as always, to EVERYONE involved in reporting and fixing security
issues for all their hard work. It really is a team effort and one
with more and more people involved all the time.
Cheers and thanks for using Moodle!
Michael de Raadt
Development Manager, Moodle HQ
==============================
MSA-12-0051: File upload size constraint issue
Topic: /repository/repository_ajax.
-1 for "maxbytes" and side step moodle file size
restrictions
Severity/Risk: Minor
Versions affected: 2.3 to 2.3.1+, 2.2 to 2.2.3+
Reported by: Andrew Davis
Issue no.: MDL-30792
CVE Identifier: CVE-2012-4400
Changes (master):
http://git.moodle.org/gw?p=
Description:
It was possible for a user to manipulate script parameters to upload a
file larger than set limits.
==============================
MSA-12-0052: Course topics permission issue
Topic: Permissions problems in topic course format
Severity/Risk: Minor
Versions affected: 2.3 to 2.3.1+, 2.2 to 2.2.3+
Reported by: Alexander Bias
Issue no.: MDL-28207
CVE Identifier: 2012-4401
Changes (master):
http://git.moodle.org/gw?p=
Description:
Users with course editing capabilities, but without permission to
show/hide topics and set the current topic were able to complete
these actions under certain conditions.
==============================
MSA-12-0053: Blog file access issue
Topic: 'publishstate' === 'public'
Severity/Risk: Minor
Versions affected: 2.3 to 2.3.1+, 2.2 to 2.2.3+, 2.1 to 2.1.6+
Reported by: Kyle Decot
Issue no.: MDL-34585
CVE Identifier: CVE-2012-4407
Changes (master):
http://git.moodle.org/gw?p=
Description:
Files embedded as part of a blog were being delivered without checking
the publication state properly.
==============================
MSA-12-0054: Course reset permission issue
Topic: Course reset not protected by proper capability
Severity/Risk: Minor
Versions affected: 2.3 to 2.3.1+, 2.2 to 2.2.3+, 2.1 to 2.1.6+
Reported by: Rex Lorenzo
Issue no.: MDL-34519
CVE Identifier: CVE-2012-4408
Changes (master):
http://git.moodle.org/gw?p=
Description:
The course reset link was protected by a correct permission but the
reset page itself was being checked for a different permission.
==============================
MSA-12-0055: Web service access token issue
Topic: A web service token allows the user to run functions
from any external service, not just those linked to
the external service the token is for
Severity/Risk: Serios
Versions affected: 2.3 to 2.3.1+, 2.2 to 2.2.3+, 2.1 to 2.1.6+
Reported by: Nathan Mares
Issue no.: MDL-34368
CVE Identifier: CVE-2012-4402
Changes (master):
http://git.moodle.org/gw?p=
Description:
Users with permission to access multiple services were able to use a
token from one service to access another.
==============================
MSA-12-0056: Information leak in drag-and-drop
Topic: Information disclosure in yui_combo.php
Severity/Risk: Minor
Versions affected: 2.3 to 2.3.1+
Reported by: Mark Baseggio
Issue no.: MDL-35168
CVE Identifier: CVE-2012-4403
Changes (master):
http://git.moodle.org/gw?p=
Description:
The drag-and-drop script was responding to bad requests with
information that included the full path to scripts on the server.
--
You are receiving this email because you registered a Moodle site with Moodle.org
and chose to be added to this low-volume list of security notifications and other
important Moodle-related announcements for Moodle administrators.
To unsubscribe you can re-register your site (as above) and make sure you
turn the email option OFF in the registration form. You can also send
a blank email to sympa@lists.moodle.org with "unsubscribe securityalerts"
as the subject (from the email address that is subscribed).
See http://lists.moodle.org/info/
From: <michaeld@moodle.com>
Date: 2012/9/10
Subject: [securityalerts] URGENT: Moodle 2.3.2, 2.2.5 and 2.1.8 are now available
To: securityalerts@lists.moodle.
Hello registered Moodle Admins!
(This email is going out to over 84,000 registered Moodle admins. You
are receiving this email because you asked for Moodle security news
when you registered a Moodle site. If you don't want these emails
then see the very end of this email for info about unsubscribing.
Replies to this email will not be read.)
I'm writing today to let you know that Moodle 2.3.2, 2.2.5 and 2.1.8
are available via the usual open download channels
(http://download.moodle.org, CVS or Git).
Note that the 2.1 and 1.9 branches are now supported for security
fixes only. Also note that no release has been made in the 1.9 branch
as there have been no serious security issues in this branch.
The full release notes are here:
* http://docs.moodle.org/dev/
* http://docs.moodle.org/dev/
* http://docs.moodle.org/dev/
SECURITY ISSUES
As well as a long list of bug fixes, performance improvements and
polishing, there are 6 security issues you should be aware of.
Details of these security issues are listed below.
As a registered Moodle admin we are giving you advance notice of these
issues so you have some time to fix them before we publish them more
widely on http://moodle.org/security and publicise them in one week.
To avoid leaving your site vulnerable we highly recommend you upgrade
your sites to the latest Moodle version as soon as you can.
If you cannot upgrade then please check the following list carefully
and patch your own system or switch off those features.
Thanks, as always, to EVERYONE involved in reporting and fixing security
issues for all their hard work. It really is a team effort and one
with more and more people involved all the time.
Cheers and thanks for using Moodle!
Michael de Raadt
Development Manager, Moodle HQ
==============================
MSA-12-0051: File upload size constraint issue
Topic: /repository/repository_ajax.
-1 for "maxbytes" and side step moodle file size
restrictions
Severity/Risk: Minor
Versions affected: 2.3 to 2.3.1+, 2.2 to 2.2.3+
Reported by: Andrew Davis
Issue no.: MDL-30792
CVE Identifier: CVE-2012-4400
Changes (master):
http://git.moodle.org/gw?p=
Description:
It was possible for a user to manipulate script parameters to upload a
file larger than set limits.
==============================
MSA-12-0052: Course topics permission issue
Topic: Permissions problems in topic course format
Severity/Risk: Minor
Versions affected: 2.3 to 2.3.1+, 2.2 to 2.2.3+
Reported by: Alexander Bias
Issue no.: MDL-28207
CVE Identifier: 2012-4401
Changes (master):
http://git.moodle.org/gw?p=
Description:
Users with course editing capabilities, but without permission to
show/hide topics and set the current topic were able to complete
these actions under certain conditions.
==============================
MSA-12-0053: Blog file access issue
Topic: 'publishstate' === 'public'
Severity/Risk: Minor
Versions affected: 2.3 to 2.3.1+, 2.2 to 2.2.3+, 2.1 to 2.1.6+
Reported by: Kyle Decot
Issue no.: MDL-34585
CVE Identifier: CVE-2012-4407
Changes (master):
http://git.moodle.org/gw?p=
Description:
Files embedded as part of a blog were being delivered without checking
the publication state properly.
==============================
MSA-12-0054: Course reset permission issue
Topic: Course reset not protected by proper capability
Severity/Risk: Minor
Versions affected: 2.3 to 2.3.1+, 2.2 to 2.2.3+, 2.1 to 2.1.6+
Reported by: Rex Lorenzo
Issue no.: MDL-34519
CVE Identifier: CVE-2012-4408
Changes (master):
http://git.moodle.org/gw?p=
Description:
The course reset link was protected by a correct permission but the
reset page itself was being checked for a different permission.
==============================
MSA-12-0055: Web service access token issue
Topic: A web service token allows the user to run functions
from any external service, not just those linked to
the external service the token is for
Severity/Risk: Serios
Versions affected: 2.3 to 2.3.1+, 2.2 to 2.2.3+, 2.1 to 2.1.6+
Reported by: Nathan Mares
Issue no.: MDL-34368
CVE Identifier: CVE-2012-4402
Changes (master):
http://git.moodle.org/gw?p=
Description:
Users with permission to access multiple services were able to use a
token from one service to access another.
==============================
MSA-12-0056: Information leak in drag-and-drop
Topic: Information disclosure in yui_combo.php
Severity/Risk: Minor
Versions affected: 2.3 to 2.3.1+
Reported by: Mark Baseggio
Issue no.: MDL-35168
CVE Identifier: CVE-2012-4403
Changes (master):
http://git.moodle.org/gw?p=
Description:
The drag-and-drop script was responding to bad requests with
information that included the full path to scripts on the server.
--
You are receiving this email because you registered a Moodle site with Moodle.org
and chose to be added to this low-volume list of security notifications and other
important Moodle-related announcements for Moodle administrators.
To unsubscribe you can re-register your site (as above) and make sure you
turn the email option OFF in the registration form. You can also send
a blank email to sympa@lists.moodle.org with "unsubscribe securityalerts"
as the subject (from the email address that is subscribed).
See http://lists.moodle.org/info/
No hay comentarios:
Publicar un comentario