正文

Moodle 'spell-check-logic.cgi' 任意文件重写漏洞

admin
admin V管理员 /0 评论 /6 阅读
0104
此篇文章发布距今已超过1272天，您需要注意文章的内容或图片是否可用！

漏洞信息详情

Moodle 'spell-check-logic.cgi' 任意文件重写漏洞

  • CNNVD编号：CNNVD-200811-313
    • <!--
  • 危害等级： 中危-->
  • 危害等级： 中危
  • CVE编号： CVE-2008-5153
  • 漏洞类型： 后置链接
  • 发布时间： 2008-11-18
  • 威胁类型： 本地
  • 更新时间： 2009-03-07
  • 厂        商： moodle
  • 漏洞来源： Dmitry E. Oboukhov

漏洞简介

Moodle是一个开放源码面向对象模块化的电子教学软件平台。

Moodle 中的spell-check-logic.cgi允许本地用户借助一个对(1)/tmp/spell-check-debug.log,(2)/tmp/spell-check-before或(3)/tmp/spell-check-after临时文件的symlink攻击，重写任意文件。

漏洞公告

目前厂商已经发布了升级补丁以修复这个安全问题，补丁下载链接：

Debian Linux 4.0 arm

Debian moodle_1.6.3-2+etch2_all.deb

http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+etch2_all.deb

Ubuntu Ubuntu Linux 8.04 LTS powerpc

Ubuntu moodle_1.8.2-1ubuntu4.2_all.deb

http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1ubuntu4.2_all.deb

Ubuntu Ubuntu Linux 8.10 powerpc

Ubuntu moodle_1.8.2-1.2ubuntu2.1_all.deb

http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1.2ubuntu2.1_all.deb

Debian Linux 4.0 powerpc

Debian moodle_1.6.3-2+etch2_all.deb

http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+etch2_all.deb

Ubuntu Ubuntu Linux 8.10 i386

Ubuntu moodle_1.8.2-1.2ubuntu2.1_all.deb

http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1.2ubuntu2.1_all.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

Ubuntu moodle_1.8.2-1ubuntu4.2_all.deb

http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1ubuntu4.2_all.deb

Debian Linux 4.0 m68k

Debian moodle_1.6.3-2+etch2_all.deb

http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+etch2_all.deb

Ubuntu Ubuntu Linux 8.04 LTS amd64

Ubuntu moodle_1.8.2-1ubuntu4.2_all.deb

http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1ubuntu4.2_all.deb

Ubuntu Ubuntu Linux 8.04 LTS lpia

Ubuntu moodle_1.8.2-1ubuntu4.2_all.deb

http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1ubuntu4.2_all.deb

Ubuntu Ubuntu Linux 8.10 lpia

Ubuntu moodle_1.8.2-1.2ubuntu2.1_all.deb

http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1.2ubuntu2.1_all.deb

Debian Linux 4.0 amd64

Debian moodle_1.6.3-2+etch2_all.deb

http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+etch2_all.deb

Debian Linux 4.0 ia-32

Debian moodle_1.6.3-2+etch2_all.deb

http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+etch2_all.deb

Debian Linux 4.0 hppa

Debian moodle_1.6.3-2+etch2_all.deb

http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+etch2_all.deb

Debian Linux 4.0 sparc

Debian moodle_1.6.3-2+etch2_all.deb

http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+etch2_all.deb

Debian Linux 4.0 s/390

Debian moodle_1.6.3-2+etch2_all.deb

http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+etch2_all.deb

Ubuntu Ubuntu Linux 8.10 sparc

Ubuntu moodle_1.8.2-1.2ubuntu2.1_all.deb

http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1.2ubuntu2.1_all.deb

Debian Linux 4.0 alpha

Debian moodle_1.6.3-2+etch2_all.deb

http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+etch2_all.deb

Debian Linux 4.0

Debian moodle_1.6.3-2+etch2_all.deb

http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+etch2_all.deb

Ubuntu Ubuntu Linux 8.04 LTS i386

Ubuntu moodle_1.8.2-1ubuntu4.2_all.deb

http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1ubuntu4.2_all.deb

Debian Linux 4.0 mipsel

Debian moodle_1.6.3-2+etch2_all.deb

http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+etch2_all.deb

Ubuntu Ubuntu Linux 8.10 amd64

Ubuntu moodle_1.8.2-1.2ubuntu2.1_all.deb

http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1.2ubuntu2.1_all.deb

Debian Linux 4.0 ia-64

Debian moodle_1.6.3-2+etch2_all.deb

http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+etch2_all.deb

Debian Linux 4.0 mips

Debian moodle_1.6.3-2+etch2_all.deb

http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+etch2_all.deb

参考网址

来源: XF

名称: moodle-spellchecklogic-symlink(46708)

链接:http://xforce.iss.net/xforce/xfdb/46708

来源: BID

名称: 32402

链接:http://www.securityfocus.com/bid/32402

来源: MISC

链接:http://uvw.ru/report.sid.txt

来源: MLIST

名称: [debian-devel] 20080813 Re: Possible mass bug filing: The possibility of attack with the help of symlinks in some Debian packages

链接:http://lists.debian.org/debian-devel/2008/08/msg00347.html

受影响实体

  • Moodle Moodle:1.8.2  
    <!--
    2000-1-1
    -->

补丁

    暂无