Moodle upstream has released latest stable versions (1.9.7 and 1.8.11), fixing multiple security issues. The list for 1.9.7 release:
-------------------------- Security issues * MSA-09-0022 - Multiple CSRF problems fixed * MSA-09-0023 - Fixed user account disclosure in LAMS module * MSA-09-0024 - Fixed insufficient access control in Glossary module

  - MSA-09-0025 - Unneeded MD5 hashes removed from user     table * MSA-09-0026 - Fixed invalid application access     control in MNET interface * MSA-09-0027 - Ensured login     information is always sent secured when using SSL for     logins * MSA-09-0028 - Passwords and secrets are no     longer ever saved in backups, new backup capabilities     moodle/backup:userinfo and moodle/restore:userinfo for     controlling who can backup/restore user data, new checks     in the security overview report help admins identify     dangerous backup permissions * MSA-09-0029 - A strong     password policy is now enabled by default, enabling     password salt in encouraged in config.php, admins are     forced to change password after the upgrade and admins     can force password change on other users via Bulk user     actions * MSA-09-0030 - New detection of insecure Flash     player plugins, Moodle won't serve Flash to insecure     plugins * MSA-09-0031 - Fixed SQL injection in SCORM     module The list for 1.8.11 release:
    ---------------------------- Security issues *     MSA-09-0022 - Multiple CSRF problems fixed * MSA-09-0023
    - Fixed user account disclosure in LAMS module *     MSA-09-0024 - Fixed insufficient access control in     Glossary module * MSA-09-0025 - Unneeded MD5 hashes     removed from user table * MSA-09-0026 - Fixed invalid     application access control in MNET interface *     MSA-09-0027 - Ensured login information is always sent     secured when using SSL for logins * MSA-09-0028 -     Passwords and secrets are no longer ever saved in     backups, new backup capabilities moodle/backup:userinfo     and moodle/restore:userinfo for controlling who can     backup/restore user data * MSA-09-0029 - Enabling a     password salt in encouraged in config.php and admins are     forced to change password after the upgrade *     MSA-09-0031 - Fixed SQL injection in SCORM module     References: -----------     http://docs.moodle.org/en/Moodle_1.9.7_release_notes     http://docs.moodle.org/en/Moodle_1.8.11_release_notes     CVE Request: ------------     http://www.openwall.com/lists/oss-security/2009/12/06/1

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

このパッチにより、Moodle が最新の安定版（stable）Upstream バージョン（1.9.7）に更新され、以下の複数のセキュリティ問題が修正されます：CVE-2009-4297、CVE-2009-4298、CVE-2009-4299、CVE-2009-4300、CVE-2009-4301、CVE-2009-4302、CVE-2009-4303、CVE-2009-4304、CVE-2009-4305、MSA-09-0030（セキュアでない Flash プレイヤープラグインの新規検出）

新バージョンには、完全に新しい、よりセキュアなパスワード処理も含まれています。他の機能に加え、更新の後、管理者は次回ログインの際パスワードの変更を求められます。

This patch updates Moodle to the latest stable upstream version (1.9.7) fixing multiple security issues: CVE-2009-4297, CVE-2009-4298, CVE-2009-4299, CVE-2009-4300, CVE-2009-4301, CVE-2009-4302, CVE-2009-4303, CVE-2009-4304, CVE-2009-4305, MSA-09-0030 (New detection of insecure Flash player plugins)

The new version also has a completely new , more secure password handling. Beside other features, Admins will be asked to change their passwords next time they log in after upgrading.

The version of Moodle installed on the remote host is potentially vulnerable to multiple flaws.

  - Multiple cross-site request forger issues. (MSA-09-0022)

  - User account disclosure in LAMS module. (MSA-09-0023)

  - Insufficient access control may allow unauthorized users to view glossary entries. (MSA-09-0024)

  - Invalid application access control in MNET interface could allow execution of any MNET function from all registered remote servers. (MSA-09-0026)

  - Login information can be sent unsecured even when a site is configured to use SSL for logins. (MSA-09-0027)

  - A SQL injection issue in the SCORM module. (MSA-09-0031)

ID	名前	製品	ファミリー	公開日	更新日	深刻度
43119	Fedora 10 : moodle-1.9.7-1.fc10 (2009-13040)	Nessus	Fedora Local Security Checks	2009/12/14	2021/1/11	high
44608	openSUSE セキュリティ更新：moodle（moodle-1933）	Nessus	SuSE Local Security Checks	2010/2/15	2021/1/14	high
44613	openSUSE セキュリティ更新：moodle（moodle-1933）	Nessus	SuSE Local Security Checks	2010/2/15	2021/1/14	high
44613	openSUSE Security Update : moodle (moodle-1933)	Nessus	SuSE Local Security Checks	2010/2/15	2021/1/14	high
43123	Fedora 11 : moodle-1.9.7-1.fc11 (2009-13080)	Nessus	Fedora Local Security Checks	2009/12/14	2021/1/11	high
43121	Fedora 12 : moodle-1.9.7-1.fc12 (2009-13065)	Nessus	Fedora Local Security Checks	2009/12/14	2021/1/11	high
44608	openSUSE Security Update : moodle (moodle-1933)	Nessus	SuSE Local Security Checks	2010/2/15	2021/1/14	high
5257	Moodle < 1.8.11 / 1.9.x < 1.9.7 Multiple Vulnerabilities	Nessus Network Monitor	CGI	2009/12/9	2019/3/6	high

検出

プラグインの検索

high

high

high

high

high

high

high

high