Por lo que creamos una serie especifica a las actualizaciones que nos vayan llegando
- URGENTE: Moodle 2.0.3 y Moodle 1.9.12 están disponibles ahora con revisiones de seguridad
- URGENTE: Moodle 2.1.1, Moodle 2.0.4 y Moodle 1.9.13 están disponibles ahora con los parches de seguridad
Hola Administradores de Moodle registrados!
(Este correo electrónico está saliendo a más de 75.000 administradores de Moodle registrados. Usted
Recibes este mensaje porque usted pidió para Moodle noticias sobre seguridad
cuando se registró un sitio Moodle. Si usted no quiere que estos mensajes de correo electrónico
a continuación, ver el final de este e-mail para información acerca de darse de baja)
Estoy escribiendo hoy en día para hacerle saber que Moodle 2.1.1, 2.0.4, 1.9.12 y se
disponible a través de los canales habituales de descarga abierta
( http://download.moodle.org , CVS o Git).
La notas de la versión completa está aquí:
* http://docs.moodle.org/dev/
* http://docs.moodle.org/dev/
* http://docs.moodle.org/dev/
CUESTIONES DE SEGURIDAD
Así como una larga lista de correcciones de errores, mejoras de rendimiento y
pulido, hay 9 temas de seguridad que debe tener en cuenta.
Como administrador de Moodle registrados que le estamos dando aviso previo de estas
problemas para que tenga tiempo para corregirlos antes de su publicación más
ampliamente en http://moodle.org/security y difundirlos.
Para evitar dejar su sitio vulnerable es muy recomendable actualizar
sus sitios a la última versión de Moodle, tan pronto como sea posible.
Si no se puede actualizar, por favor consulte la siguiente lista con cuidado y
poner en práctica las soluciones provisionales o parches.
Gracias como siempre a todos los involucrados en la información y de fijación de seguridad
problemas por todo su trabajo duro. Realmente es un esfuerzo de equipo y un
con más y más personas involucradas en todo momento.
Saludos y gracias por usar Moodle!
==============================
MSA-11-0018: A falta de controles sobre la capacidad de cohortes
Tema: Estudio de cohorte problemas plugin de inscribir a la capacidad y los desaparecidos
cohorte de control de acceso
Gravedad / riesgo: menor
Versiones afectadas: <2.0.4, <2.1.1 (1.9.x no afectados)
Reportado por: Petr Škoda
El n °:. MDL-28462
Solución: actualizar a 2.0.4 o 2.1.1
Solución: Evite el uso de las cohortes
Descripción:
A fin de controlar de forma segura a la creación y supervisión de las cohortes,
capacidades adicionales han sido introducidos.
==============================
MSA-11-0019: Temas escribir en archivos fuera del directorio de datos Moodle
Tema: Tema carpeta de caché
Gravedad / riesgo: menor
Versiones afectadas: <2.0.4, <2.1.1 (1.9.x no afectados)
Reportado por: Mateo Davidson
El n °:. MDL-28147
Solución: actualizar a 2.0.4 o 2.1.1
Solución: aplicar el parche Git
Descripción:
Cuando la memoria caché está mal controlado por un tema, no fue el
posibilidad de escribir en el directorio temporal de un sistema de archivos.
==============================
MSA-11-0020: Siga los enlaces en los mensajes de error puede llevar fuera de las instalaciones
Tema: Continuación de enlace a veces puede enlace a otra página
Gravedad / riesgo: menor
Versiones afectadas: <01/09/13, <2.0.4, <2.1.1
Reportado por: Matt Meisberger
El n °:. MDL-27464
Solución: actualizar a la última versión
Solución: aplicar el parche
Descripción:
Era posible para los enlaces de mensajes de error de llevar fuera de las instalaciones
==============================
MSA-11-0021: no asignación de roles web función de servicio las siguientes restricciones
Tema: moodle_enrol_external: role_assign () no obedece a
restricciones de asignación de roles
Gravedad / riesgo: menor
Versiones afectadas: <2.0.4, <2.1.1 (1.9.x no afectados)
Reportado por: Petr Škoda
El n °:. MDL-28350
Solución: actualizar a 2.0.4 o 2.1.1
Solución: evitar el uso de servicios web
Descripción:
No todas las funciones pueden ser asignadas por todo el mundo en todos los contextos, pero esto
no se comprueba
==============================
MSA-11-0022: Curso de creadores podrían cambiar los filtros a nivel de curso
Tema: Curso papel creador tiene permisos incorrectos por defecto
Gravedad / riesgo: menor
Versiones afectadas: <2.0.4, <2.1.1 (1.9.x no afectados)
Reportado por: Ray Lawrence
El n °:. MDL-27994
Solución: modifique manualmente los permisos en sitios antiguos para eliminar
los derechos de los creadores de curso
Descripción:
Los permisos por defecto para los creadores de curso les permitió modificar
filtros de curso, que fue un problema para los usuarios con funciones mixtas
==============================
MSA-11-0023: Los clientes pueden añadir comentarios a las actividades de la primera página
Tema: Los clientes pueden añadir comentarios a las actividades de la primera página
Gravedad / riesgo: grave
Versiones afectadas: <2.0.4, <2.1.1 (1.9.x no afectados)
Reportado por: Helen Foster,
El n °:. MDL-28503
Solución: actualizar a 2.0.4 o 2.1.1
Solución: Evitar añadir bloques de comentarios a las páginas de acceso de los clientes
Descripción:
Con esta capacidad ha sido posible para los usuarios que no se registraron para
enviar comentarios.
==============================
MSA-11-0024: Reconocer las imágenes estaban siendo autenticado desde un servidor antiguo
Tema: Reconocer sigue siendo la autenticación de servidores antiguos en Moodle 1.9
Gravedad / riesgo: menor
Versiones afectadas: <01/09/13 (2.x no se ve afectada)
Reportado por: Ryan Charpentier
El n °:. MDL-27889
Solución: actualizar a 1.9.13
Solución: cambiar manualmente el URL de " https://www.google.com/
Descripción:
Moodle está todavía tratando de conectarse a servidores de la antigua Reconocer. Desde
Google ha comprado Reconocer, este servidor ha cambiado.
==============================
MSA-11-0025: Los nombres de grupo de usuarios subir CSV no se escapó
Tema: Vulnerabilidad de inyección SQL en el usuario cargar
Gravedad / riesgo: grave
Versiones afectadas: <01/09/13 (2.x no se ve afectada)
Reportado por: Matt Meisberger
El n °:. MDL-28197
Solución: actualizar a 1.9.13
Solución: las cotizaciones de escape en usuarios subir archivos CSV
Descripción:
Al cargar un archivo CSV con los nombres de grupos que contienen comillas, esto
podría arrojar el proceso de SQL. Esto sólo es aprovechable por los administradores,
pero accidentalmente podría conducir a la corrupción DB
==============================
MSA-11-0026: no en los campos de usuario subir CSV que se escapó
Tema: las inscripciones de archivos sin formato tiene varias de inyección SQL
vulnerabilidades
Gravedad / riesgo: grave
Versiones afectadas: <01/09/13 (2.x no se ve afectada)
Reportado por: Matt Meisberger
Nn problema:. MDL-28360
Solución: actualizar a 1.9.13
Solución: las cotizaciones de escape en usuarios subir archivos CSV
Descripción:
Al cargar un archivo CSV con campos que contienen comillas, esto podría
deshacerse de SQL de procesamiento. Esto sólo es aprovechable por los administradores, pero
accidental podría dar lugar a la corrupción DB
==============================
-
Usted está recibiendo este email porque se ha registrado un sitio Moodle con Moodle.org
y optó por añadir a esta lista de bajo volumen de las notificaciones de seguridad y otros
Moodle importantes anuncios relacionados con los administradores de Moodle.
Para darse de baja puede volver a registrar su sitio (como antes) y asegúrese de que
a su vez la opción de correo electrónico fuera en el formulario de inscripción. También puede enviar
un mensaje en blanco a sympa@lists.moodle.org con "securityalerts darse de baja"
como el tema (de la dirección de correo electrónico que está suscrito).
Ver http://lists.moodle.org/info/
---------- Forwarded message ----------
From: Martin Dougiamas <martin@moodle.com>
Date: 2011/8/1
Subject: [securityalerts] URGENT: Moodle 2.1.1, Moodle 2.0.4 and Moodle 1.9.13 are now available with security fixes
To: securityalerts <securityalerts@lists.moodle.
Hello registered Moodle Admins!
(This email is going out to over 75,000 registered Moodle admins. You
are receiving this email because you asked for Moodle security news
when you registered a Moodle site. If you don't want these emails
then see the very end of this email for info about unsubscribing)
I'm writing today to let you know that Moodle 2.1.1, 2.0.4, and 1.9.12 are
available via the usual open download channels
(http://download.moodle.org, CVS or Git).
The full release notes are here:
* http://docs.moodle.org/dev/
* http://docs.moodle.org/dev/
* http://docs.moodle.org/dev/
SECURITY ISSUES
As well as a long list of bug fixes, performance improvements and
polishing, there are 9 security issues you should be aware of.
As a registered Moodle admin we are giving you advance notice of these
issues so you have some time to fix them before we publish them more
widely on http://moodle.org/security and publicize them.
To avoid leaving your site vulnerable we highly recommend you upgrade
your sites to the latest Moodle version as soon as you can.
If you cannot upgrade then please check the following list carefully and
implement the provided workarounds or patches.
Thanks as always to EVERYONE involved in reporting and fixing security
issues for all their hard work. It really is a team effort and one
with more and more people involved all the time.
Cheers and thanks for using Moodle!
==============================
MSA-11-0018: Lacking capability controls over cohorts
Topic: Cohort enrol plugin capability problems and missing
cohort access control
Severity/Risk: Minor
Versions affected: < 2.0.4, < 2.1.1 (1.9.x not affected)
Reported by: Petr Škoda
Issue no.: MDL-28462
Solution: upgrade to 2.0.4 or 2.1.1
Workaround: Avoid using cohorts
Description:
In order to securely control the creation and oversight of cohorts,
additional capabilities have been introduced.
==============================
MSA-11-0019: Themes writing to files outside Moodle data directory
Topic: Theme cache folder
Severity/Risk: Minor
Versions affected: < 2.0.4, < 2.1.1 (1.9.x not affected)
Reported by: Matthew Davidson
Issue no.: MDL-28147
Solution: upgrade to 2.0.4 or 2.1.1
Workaround: apply Git patch
Description:
When caching is incorrectly controlled by a theme, there was the
potential for writing to a file system's temporary directory.
==============================
MSA-11-0020: Continue links in error messages can lead offsite
Topic: Continuation link can sometimes link offsite
Severity/Risk: Minor
Versions affected: < 1.9.13, < 2.0.4, < 2.1.1
Reported by: Matt Meisberger
Issue no.: MDL-27464
Solution: upgrade to latest version
Workaround: apply patch
Description:
It was possible for error message links to lead offsite
==============================
MSA-11-0021: Role assignment web service function not following restrictions
Topic: moodle_enrol_external:role_
role assignment restrictions
Severity/Risk: Minor
Versions affected: < 2.0.4, < 2.1.1 (1.9.x not affected)
Reported by: Petr Škoda
Issue no.: MDL-28350
Solution: upgrade to 2.0.4 or 2.1.1
Workaround: avoid using web services
Description:
Not all roles may be assigned by everybody in all contexts, but this
was not being checked
==============================
MSA-11-0022: Course creators could change filters at course level
Topic: Course creator role has incorrect default permissions
Severity/Risk: Minor
Versions affected: < 2.0.4, < 2.1.1 (1.9.x not affected)
Reported by: Ray Lawrence
Issue no.: MDL-27994
Solution: Manually alter permissions in older sites to remove
rights from course creators
Description:
The default permission for course creators allowed them to alter
course filters, which was an issue for users with mixed roles
==============================
MSA-11-0023: Guests can add comments to front page activities
Topic: Guests can add comments to front page activities
Severity/Risk: Serious
Versions affected: < 2.0.4, < 2.1.1 (1.9.x not affected)
Reported by: Helen Foster
Issue no.: MDL-28503
Solution: upgrade to 2.0.4 or 2.1.1
Workaround: Avoid adding comment blocks to pages accessible by guests
Description:
With this ability it was possible for users who were not logged in to
post comments.
==============================
MSA-11-0024: Recaptcha images were being authenticated from an older server
Topic: Recaptcha is still authenticating to old servers on Moodle 1.9
Severity/Risk: Minor
Versions affected: < 1.9.13 (2.x not affected)
Reported by: Ryan Charpentier
Issue no.: MDL-27889
Solution: upgrade to 1.9.13
Workaround: manually change URL to "https://www.google.com/
Description:
Moodle is still trying to connect to the old Recaptcha servers. Since
Google has purchased Recaptcha, this server has changed.
==============================
MSA-11-0025: Group names in user upload CSV not being escaped
Topic: SQL injection vulnerability in user upload
Severity/Risk: Serious
Versions affected: < 1.9.13 (2.x not affected)
Reported by: Matt Meisberger
Issue no.: MDL-28197
Solution: upgrade to 1.9.13
Workaround: Escape quotes in user upload CSV files
Description:
When uploading a CSV file with group names that contain quotes, this
could throw off SQL processing. This is only exploitable by admins,
but could accidentally lead to DB corruption
==============================
MSA-11-0026: Fields in user upload CSV not being escaped
Topic: Flat file enrollments has various sql injection
vulnerabilities
Severity/Risk: Serious
Versions affected: < 1.9.13 (2.x not affected)
Reported by: Matt Meisberger
Issue nos.: MDL-28360
Solution: upgrade to 1.9.13
Workaround: Escape quotes in user upload CSV files
Description:
When uploading a CSV files with fields containing quotes, this could
throw off SQL processing. This is only exploitable by admins, but
could accidentally lead to DB corruption
==============================
--
You are receiving this email because you registered a Moodle site with Moodle.org
and chose to be added to this low-volume list of security notifications and other
important Moodle-related announcements for Moodle administrators.
To unsubscribe you can re-register your site (as above) and make sure you
turn the email option OFF in the registration form. You can also send
a blank email to sympa@lists.moodle.org with "unsubscribe securityalerts"
as the subject (from the email address that is subscribed).
See http://lists.moodle.org/info/
From: Martin Dougiamas <martin@moodle.com>
Date: 2011/8/1
Subject: [securityalerts] URGENT: Moodle 2.1.1, Moodle 2.0.4 and Moodle 1.9.13 are now available with security fixes
To: securityalerts <securityalerts@lists.moodle.
Hello registered Moodle Admins!
(This email is going out to over 75,000 registered Moodle admins. You
are receiving this email because you asked for Moodle security news
when you registered a Moodle site. If you don't want these emails
then see the very end of this email for info about unsubscribing)
I'm writing today to let you know that Moodle 2.1.1, 2.0.4, and 1.9.12 are
available via the usual open download channels
(http://download.moodle.org, CVS or Git).
The full release notes are here:
* http://docs.moodle.org/dev/
* http://docs.moodle.org/dev/
* http://docs.moodle.org/dev/
SECURITY ISSUES
As well as a long list of bug fixes, performance improvements and
polishing, there are 9 security issues you should be aware of.
As a registered Moodle admin we are giving you advance notice of these
issues so you have some time to fix them before we publish them more
widely on http://moodle.org/security and publicize them.
To avoid leaving your site vulnerable we highly recommend you upgrade
your sites to the latest Moodle version as soon as you can.
If you cannot upgrade then please check the following list carefully and
implement the provided workarounds or patches.
Thanks as always to EVERYONE involved in reporting and fixing security
issues for all their hard work. It really is a team effort and one
with more and more people involved all the time.
Cheers and thanks for using Moodle!
==============================
MSA-11-0018: Lacking capability controls over cohorts
Topic: Cohort enrol plugin capability problems and missing
cohort access control
Severity/Risk: Minor
Versions affected: < 2.0.4, < 2.1.1 (1.9.x not affected)
Reported by: Petr Škoda
Issue no.: MDL-28462
Solution: upgrade to 2.0.4 or 2.1.1
Workaround: Avoid using cohorts
Description:
In order to securely control the creation and oversight of cohorts,
additional capabilities have been introduced.
==============================
MSA-11-0019: Themes writing to files outside Moodle data directory
Topic: Theme cache folder
Severity/Risk: Minor
Versions affected: < 2.0.4, < 2.1.1 (1.9.x not affected)
Reported by: Matthew Davidson
Issue no.: MDL-28147
Solution: upgrade to 2.0.4 or 2.1.1
Workaround: apply Git patch
Description:
When caching is incorrectly controlled by a theme, there was the
potential for writing to a file system's temporary directory.
==============================
MSA-11-0020: Continue links in error messages can lead offsite
Topic: Continuation link can sometimes link offsite
Severity/Risk: Minor
Versions affected: < 1.9.13, < 2.0.4, < 2.1.1
Reported by: Matt Meisberger
Issue no.: MDL-27464
Solution: upgrade to latest version
Workaround: apply patch
Description:
It was possible for error message links to lead offsite
==============================
MSA-11-0021: Role assignment web service function not following restrictions
Topic: moodle_enrol_external:role_
role assignment restrictions
Severity/Risk: Minor
Versions affected: < 2.0.4, < 2.1.1 (1.9.x not affected)
Reported by: Petr Škoda
Issue no.: MDL-28350
Solution: upgrade to 2.0.4 or 2.1.1
Workaround: avoid using web services
Description:
Not all roles may be assigned by everybody in all contexts, but this
was not being checked
==============================
MSA-11-0022: Course creators could change filters at course level
Topic: Course creator role has incorrect default permissions
Severity/Risk: Minor
Versions affected: < 2.0.4, < 2.1.1 (1.9.x not affected)
Reported by: Ray Lawrence
Issue no.: MDL-27994
Solution: Manually alter permissions in older sites to remove
rights from course creators
Description:
The default permission for course creators allowed them to alter
course filters, which was an issue for users with mixed roles
==============================
MSA-11-0023: Guests can add comments to front page activities
Topic: Guests can add comments to front page activities
Severity/Risk: Serious
Versions affected: < 2.0.4, < 2.1.1 (1.9.x not affected)
Reported by: Helen Foster
Issue no.: MDL-28503
Solution: upgrade to 2.0.4 or 2.1.1
Workaround: Avoid adding comment blocks to pages accessible by guests
Description:
With this ability it was possible for users who were not logged in to
post comments.
==============================
MSA-11-0024: Recaptcha images were being authenticated from an older server
Topic: Recaptcha is still authenticating to old servers on Moodle 1.9
Severity/Risk: Minor
Versions affected: < 1.9.13 (2.x not affected)
Reported by: Ryan Charpentier
Issue no.: MDL-27889
Solution: upgrade to 1.9.13
Workaround: manually change URL to "https://www.google.com/
Description:
Moodle is still trying to connect to the old Recaptcha servers. Since
Google has purchased Recaptcha, this server has changed.
==============================
MSA-11-0025: Group names in user upload CSV not being escaped
Topic: SQL injection vulnerability in user upload
Severity/Risk: Serious
Versions affected: < 1.9.13 (2.x not affected)
Reported by: Matt Meisberger
Issue no.: MDL-28197
Solution: upgrade to 1.9.13
Workaround: Escape quotes in user upload CSV files
Description:
When uploading a CSV file with group names that contain quotes, this
could throw off SQL processing. This is only exploitable by admins,
but could accidentally lead to DB corruption
==============================
MSA-11-0026: Fields in user upload CSV not being escaped
Topic: Flat file enrollments has various sql injection
vulnerabilities
Severity/Risk: Serious
Versions affected: < 1.9.13 (2.x not affected)
Reported by: Matt Meisberger
Issue nos.: MDL-28360
Solution: upgrade to 1.9.13
Workaround: Escape quotes in user upload CSV files
Description:
When uploading a CSV files with fields containing quotes, this could
throw off SQL processing. This is only exploitable by admins, but
could accidentally lead to DB corruption
==============================
--
You are receiving this email because you registered a Moodle site with Moodle.org
and chose to be added to this low-volume list of security notifications and other
important Moodle-related announcements for Moodle administrators.
To unsubscribe you can re-register your site (as above) and make sure you
turn the email option OFF in the registration form. You can also send
a blank email to sympa@lists.moodle.org with "unsubscribe securityalerts"
as the subject (from the email address that is subscribed).
See http://lists.moodle.org/info/
No hay comentarios:
Publicar un comentario