Ubuntu
mahara package

privilege escalation for institution admins CVE-2009-3298

Bug #463082 reported by François Marier
258
This bug affects 1 person
Affects Status Importance Assigned to Milestone
mahara (Ubuntu)
Fix Released
Undecided
François Marier
Jaunty
Fix Released
Undecided
Unassigned
Karmic
Fix Released
Undecided
Unassigned
Lucid
Fix Released
Undecided
François Marier

Bug Description

Binary package hint: mahara

Using an institutional administrator account to reset the password of the global site administrator if the site administrator is a member of the institution.

François Marier (fmarier)
Changed in mahara (Ubuntu):
assignee: nobody → François Marier (fmarier)
Revision history for this message
François Marier (fmarier) wrote :
Revision history for this message
François Marier (fmarier) wrote :
Jamie Strandboge (jdstrand)
Changed in mahara (Ubuntu Jaunty):
status: New → In Progress
Changed in mahara (Ubuntu Karmic):
status: New → In Progress
Jamie Strandboge (jdstrand)
Changed in mahara (Ubuntu Lucid):
status: New → Confirmed
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

This is now public: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3298

visibility: private → public
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Thanks for the debdiffs!

The jaunty debdiff did not apply cleanly due to the previous version's pocket. Both debdiffs need to use '-security' as part of the distribution name. See https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation#Packaging for details.

I have fixed these and will upload them shortly.

Changed in mahara (Ubuntu Jaunty):
status: In Progress → Fix Committed
Changed in mahara (Ubuntu Karmic):
status: In Progress → Fix Committed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package mahara - 1.1.5-1ubuntu1

---------------
mahara (1.1.5-1ubuntu1) lucid; urgency=low

  [ Francois Marier ]
  * SECURITY UPDATE: privilege escalation (LP: #463082)
    - debian/patches/CVE-2009-3298.dpatch: fix from upstream
    - CVE-2009-3298
  * SECURITY UPDATE: cross-site scripting vulnerability (LP: #463083)
    - debian/patches/CVE-2009-3299.dpatch: fix from upstream
    - CVE-2009-3299
  * Add dpatch support

 -- Jamie Strandboge <email address hidden> Wed, 04 Nov 2009 11:29:22 -0600

Changed in mahara (Ubuntu Lucid):
status: Confirmed → Fix Released
Jamie Strandboge (jdstrand)
Changed in mahara (Ubuntu Jaunty):
status: Fix Committed → Fix Released
Changed in mahara (Ubuntu Karmic):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.