(Este correo electrónico va a más de 92.000 administradores de Moodle registrados. Usted es
recibiendo este correo electrónico porque usted pidió noticias de seguridad de Moodle cuando
registrado un sitio Moodle. Si usted no quiere que estos mensajes de correo electrónico a continuación, ver el final
de este correo electrónico para obtener información acerca de cancelar la suscripción. Las respuestas a este correo electrónico no será
leer.)
Estoy escribiendo hoy para hacerle saber que Moodle 2.6.1, 2.5.4, 2.4.8, 2.3.11 son
disponible a través de los canales habituales de descarga abiertos ( http://download.moodle.org
o GIT).
Tenga en cuenta la rama 2.4 es ahora compatible correcciones de seguridad solamente y 2.3.11 es
la versión final de esa sucursal.
Las notas de la versión completa está aquí:
http://docs.moodle.org/dev/
http://docs.moodle.org/dev/
http://docs.moodle.org/dev/
http://docs.moodle.org/dev/
Las cuestiones de seguridad
Además de una larga lista de correcciones de errores, mejoras de rendimiento y pulir,
hay 3 problemas de seguridad que debe tener en cuenta. Los detalles de las opciones de seguridad
cuestiones se enumeran a continuación.
Como administrador de Moodle registrado que le estamos dando aviso anticipado de estas cuestiones
por lo que tiene algo de tiempo para corregirlos antes de que las hayamos publicado más ampliamente en
http://moodle.org/security en una semana.
Para evitar dejar su sitio vulnerable te recomendamos que actualices tu
sitios a la última versión de Moodle, tan pronto como sea posible.
Si no se puede actualizar, por favor, compruebe la lista siguiente cuidadosamente y patch
su propio sistema o desactivar esas características.
Gracias, como siempre, a todos los involucrados en la información y la fijación de la seguridad
cuestiones. Realmente es un esfuerzo de equipo y uno con más y más personas involucradas
todo el tiempo.
Saludos y gracias por usar Moodle!
Michael de Raadt
Gerente de Desarrollo, HQ Moodle
==============================
MSA-14-0001: Config cuestión visibilidad contraseñas
Descripción: Algunos de los cambios de contraseña en las páginas de administración estaban siendo
grabado y mostrado a los administradores en la configuración
ingrese informe.
Resumen Edición: Config Cambios Informe revela las contraseñas tan claro
texto
Gravedad / riesgo: menor
Versiones afectadas: 2.6, 2.5 a 2.5.4, 2.4 a 2.4.7 y anteriores
versiones no compatibles
Versiones fijas: 2.6.1, 2.5.4 y 2.4.8
Reportado por: Andrew Steele
El n °:. MDL-36721
Identificador de CVE: CVE-2014-0008
Cambios (maestro):
http://git.moodle.org/gw?p=
==============================
MSA-14-0002: restricciones de grupo que carecen de "iniciar sesión como"
Descripción: Los usuarios fueron capaces de iniciar la sesión como un usuario que no es en un
en el mismo grupo y sin permiso para ver todo
grupos.
Resumen Edición: Los usuarios con permiso loginas y acceder a todos los grupos
prohibida puede iniciar sesión como usuario no en un mismo grupo,
url directa
Gravedad / riesgo: menor
Versiones afectadas: 2.6, 2.5 a 2.5.4, 2.4 a 2.4.7, 2.3 a 2.3.10 y
versiones anteriores no compatibles
Versiones fijas: 2.6.1, 2.5.4, 2.4.8 y 2.3.11
Reportado por: Itamar Tzadok
El n °:. MDL-42643
Identificador de CVE: CVE-2014-0009
Cambios (maestro):
http://git.moodle.org/gw?p=
==============================
MSA-14-0003: Cross-site vulnerabilidad de falsificación de petición en los campos de perfil
Descripción: Los campos del perfil personalizado y categorías estaban abiertos a
eliminación sin comprobación sesión correcto.
Resumen Edición: Dos Cross-Site Request Forgery (CSRF) vulnerabilidades
que se encuentra en / user / profile / index.php
Gravedad / riesgo: Serious
Versiones afectadas: 2.6, 2.5 a 2.5.4, 2.4 a 2.4.7, 2.3 a 2.3.10 y
versiones anteriores no compatibles
Versiones fijas: 2.6.1, 2.5.4, 2.4.8 y 2.3.11
Reportado por: Jun Zhu
El n °:. MDL-42883
Identificador de CVE: CVE-2014-0010
Cambios (maestro):
http://git.moodle.org/gw?p=
==============================
-
Usted está recibiendo este correo electrónico porque usted registró un sitio Moodle con Moodle.org
y eligió para ser añadido a esta lista de bajo volumen de las notificaciones de seguridad y otros
anuncios importantes relacionados con Moodle para los administradores de Moodle.
Para anular su suscripción, puede volver a registrar su sitio (como antes) y asegúrese de que
activar la opción de correo electrónico OFF en el formulario de registro. También puede enviar
un mensaje en blanco a sympa@lists.moodle.org con "darse de baja" securityalerts
como el tema (de la dirección de correo electrónico que está suscrito).
Ver http://lists.moodle.org/info/
---------- Forwarded message ----------
From: <michaeld@moodle.com>
Date: 2014/1/13
Subject: [securityalerts] Moodle 2.6.1, 2.5.4, 2.4.8 and 2.3.11 are now available
To: securityalerts@lists.moodle.
Hello registered Moodle Admins!
(This email is going out to over 92,000 registered Moodle admins. You are
receiving this email because you asked for Moodle security news when you
registered a Moodle site. If you don't want these emails then see the very end
of this email for info about unsubscribing. Replies to this email will not be
read.)
I'm writing today to let you know that Moodle 2.6.1, 2.5.4, 2.4.8, 2.3.11 are
available via the usual open download channels (http://download.moodle.org
or Git).
Note the 2.4 branch is now supported for security fixes only and 2.3.11 is
the final release in that branch.
The full release notes are here:
http://docs.moodle.org/dev/
http://docs.moodle.org/dev/
http://docs.moodle.org/dev/
http://docs.moodle.org/dev/
SECURITY ISSUES
As well as a long list of bug fixes, performance improvements and polishing,
there are 3 security issues you should be aware of. Details of these security
issues are listed below.
As a registered Moodle admin we are giving you advance notice of these issues
so you have some time to fix them before we publish them more widely on
http://moodle.org/security in one week.
To avoid leaving your site vulnerable we highly recommend you upgrade your
sites to the latest Moodle version as soon as you can.
If you cannot upgrade, then please check the following list carefully and patch
your own system or switch off those features.
Thanks, as always, to EVERYONE involved in reporting and fixing security
issues. It really is a team effort and one with more and more people involved
all the time.
Cheers and thanks for using Moodle!
Michael de Raadt
Development Manager, Moodle HQ
==============================
MSA-14-0001: Config passwords visibility issue
Description: Some password changes on admin pages were being
recorded and shown to administrators in the config
log report.
Issue summary: Config Changes Report reveals passwords as plain
text
Severity/Risk: Minor
Versions affected: 2.6, 2.5 to 2.5.4, 2.4 to 2.4.7 and earlier
unsupported versions
Versions fixed: 2.6.1, 2.5.4 and 2.4.8
Reported by: Andrew Steele
Issue no.: MDL-36721
CVE identifier: CVE-2014-0008
Changes (master):
http://git.moodle.org/gw?p=
==============================
MSA-14-0002: Group constraints lacking in "log in as"
Description: Users were able to log in as a user who in a is not
in the same group without the permission to see all
groups.
Issue summary: Users with loginas permission and access all groups
prohibited can login as user not in their group by
direct url
Severity/Risk: Minor
Versions affected: 2.6, 2.5 to 2.5.4, 2.4 to 2.4.7, 2.3 to 2.3.10 and
earlier unsupported versions
Versions fixed: 2.6.1, 2.5.4, 2.4.8 and 2.3.11
Reported by: Itamar Tzadok
Issue no.: MDL-42643
CVE identifier: CVE-2014-0009
Changes (master):
http://git.moodle.org/gw?p=
==============================
MSA-14-0003: Cross-site request forgery vulnerability in profile fields
Description: Custom profile fields and categories were open to
deletion without proper session checking.
Issue summary: Two Cross-site Request Forgery(CSRF) vulnerabilities
found in /user/profile/index.php
Severity/Risk: Serious
Versions affected: 2.6, 2.5 to 2.5.4, 2.4 to 2.4.7, 2.3 to 2.3.10 and
earlier unsupported versions
Versions fixed: 2.6.1, 2.5.4, 2.4.8 and 2.3.11
Reported by: Jun Zhu
Issue no.: MDL-42883
CVE identifier: CVE-2014-0010
Changes (master):
http://git.moodle.org/gw?p=
==============================
--
You are receiving this email because you registered a Moodle site with Moodle.org
and chose to be added to this low-volume list of security notifications and other
important Moodle-related announcements for Moodle administrators.
To unsubscribe you can re-register your site (as above) and make sure you
turn the email option OFF in the registration form. You can also send
a blank email to sympa@lists.moodle.org with "unsubscribe securityalerts"
as the subject (from the email address that is subscribed).
See http://lists.moodle.org/info/
From: <michaeld@moodle.com>
Date: 2014/1/13
Subject: [securityalerts] Moodle 2.6.1, 2.5.4, 2.4.8 and 2.3.11 are now available
To: securityalerts@lists.moodle.
Hello registered Moodle Admins!
(This email is going out to over 92,000 registered Moodle admins. You are
receiving this email because you asked for Moodle security news when you
registered a Moodle site. If you don't want these emails then see the very end
of this email for info about unsubscribing. Replies to this email will not be
read.)
I'm writing today to let you know that Moodle 2.6.1, 2.5.4, 2.4.8, 2.3.11 are
available via the usual open download channels (http://download.moodle.org
or Git).
Note the 2.4 branch is now supported for security fixes only and 2.3.11 is
the final release in that branch.
The full release notes are here:
http://docs.moodle.org/dev/
http://docs.moodle.org/dev/
http://docs.moodle.org/dev/
http://docs.moodle.org/dev/
SECURITY ISSUES
As well as a long list of bug fixes, performance improvements and polishing,
there are 3 security issues you should be aware of. Details of these security
issues are listed below.
As a registered Moodle admin we are giving you advance notice of these issues
so you have some time to fix them before we publish them more widely on
http://moodle.org/security in one week.
To avoid leaving your site vulnerable we highly recommend you upgrade your
sites to the latest Moodle version as soon as you can.
If you cannot upgrade, then please check the following list carefully and patch
your own system or switch off those features.
Thanks, as always, to EVERYONE involved in reporting and fixing security
issues. It really is a team effort and one with more and more people involved
all the time.
Cheers and thanks for using Moodle!
Michael de Raadt
Development Manager, Moodle HQ
==============================
MSA-14-0001: Config passwords visibility issue
Description: Some password changes on admin pages were being
recorded and shown to administrators in the config
log report.
Issue summary: Config Changes Report reveals passwords as plain
text
Severity/Risk: Minor
Versions affected: 2.6, 2.5 to 2.5.4, 2.4 to 2.4.7 and earlier
unsupported versions
Versions fixed: 2.6.1, 2.5.4 and 2.4.8
Reported by: Andrew Steele
Issue no.: MDL-36721
CVE identifier: CVE-2014-0008
Changes (master):
http://git.moodle.org/gw?p=
==============================
MSA-14-0002: Group constraints lacking in "log in as"
Description: Users were able to log in as a user who in a is not
in the same group without the permission to see all
groups.
Issue summary: Users with loginas permission and access all groups
prohibited can login as user not in their group by
direct url
Severity/Risk: Minor
Versions affected: 2.6, 2.5 to 2.5.4, 2.4 to 2.4.7, 2.3 to 2.3.10 and
earlier unsupported versions
Versions fixed: 2.6.1, 2.5.4, 2.4.8 and 2.3.11
Reported by: Itamar Tzadok
Issue no.: MDL-42643
CVE identifier: CVE-2014-0009
Changes (master):
http://git.moodle.org/gw?p=
==============================
MSA-14-0003: Cross-site request forgery vulnerability in profile fields
Description: Custom profile fields and categories were open to
deletion without proper session checking.
Issue summary: Two Cross-site Request Forgery(CSRF) vulnerabilities
found in /user/profile/index.php
Severity/Risk: Serious
Versions affected: 2.6, 2.5 to 2.5.4, 2.4 to 2.4.7, 2.3 to 2.3.10 and
earlier unsupported versions
Versions fixed: 2.6.1, 2.5.4, 2.4.8 and 2.3.11
Reported by: Jun Zhu
Issue no.: MDL-42883
CVE identifier: CVE-2014-0010
Changes (master):
http://git.moodle.org/gw?p=
==============================
--
You are receiving this email because you registered a Moodle site with Moodle.org
and chose to be added to this low-volume list of security notifications and other
important Moodle-related announcements for Moodle administrators.
To unsubscribe you can re-register your site (as above) and make sure you
turn the email option OFF in the registration form. You can also send
a blank email to sympa@lists.moodle.org with "unsubscribe securityalerts"
as the subject (from the email address that is subscribed).
See http://lists.moodle.org/info/
