Mahara User Profile Cross Site Scripting Vulnerability

Bugtraq ID:	34677
Class:	Input Validation Error
CVE:	CVE-2009-0664
Remote:	Yes
Local:	No
Published:	Apr 22 2009 12:00AM
Updated:	Jun 26 2009 05:29PM
Credit:	Debian
Vulnerable:	Mahara Mahara 1.1.3 Mahara Mahara 1.1.2 Mahara Mahara 1.1.1 Mahara Mahara 1.0.10 Mahara Mahara 1.0.9 Mahara Mahara 1.0.8 Mahara Mahara 1.0.6 Mahara Mahara 1.0.5 Mahara Mahara 1.0.4 Mahara Mahara 1.0.3 Mahara Mahara 1.0.2 Mahara Mahara 1.0.1 Mahara Mahara 1.0 Mahara Mahara 0.9.1 Mahara Mahara 0.9 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0
Not Vulnerable:

Mahara User Profile Cross Site Scripting Vulnerability

Mahara is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Mahara User Profile Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Mahara User Profile Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for more information.


Debian Linux 5.0 hppa

• Debian mahara-apache2_1.0.4-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1 .0.4-4+lenny2_all.deb


• Debian mahara-apache2_1.0.4-4+lenny3_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1 .0.4-4+lenny3_all.deb


• Debian mahara_1.0.4-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+l enny2_all.deb


• Debian mahara_1.0.4-4+lenny3_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+l enny3_all.deb

Debian Linux 5.0 ia-64

• Debian mahara-apache2_1.0.4-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1 .0.4-4+lenny2_all.deb


• Debian mahara-apache2_1.0.4-4+lenny3_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1 .0.4-4+lenny3_all.deb


• Debian mahara_1.0.4-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+l enny2_all.deb


• Debian mahara_1.0.4-4+lenny3_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+l enny3_all.deb

Debian Linux 5.0 m68k

• Debian mahara-apache2_1.0.4-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1 .0.4-4+lenny2_all.deb


• Debian mahara-apache2_1.0.4-4+lenny3_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1 .0.4-4+lenny3_all.deb


• Debian mahara_1.0.4-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+l enny2_all.deb


• Debian mahara_1.0.4-4+lenny3_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+l enny3_all.deb

Debian Linux 5.0 arm

• Debian mahara-apache2_1.0.4-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1 .0.4-4+lenny2_all.deb


• Debian mahara-apache2_1.0.4-4+lenny3_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1 .0.4-4+lenny3_all.deb


• Debian mahara_1.0.4-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+l enny2_all.deb


• Debian mahara_1.0.4-4+lenny3_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+l enny3_all.deb

Debian Linux 5.0 armel

• Debian mahara-apache2_1.0.4-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1 .0.4-4+lenny2_all.deb


• Debian mahara-apache2_1.0.4-4+lenny3_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1 .0.4-4+lenny3_all.deb


• Debian mahara_1.0.4-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+l enny2_all.deb


• Debian mahara_1.0.4-4+lenny3_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+l enny3_all.deb

Debian Linux 5.0

• Debian mahara-apache2_1.0.4-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1 .0.4-4+lenny2_all.deb


• Debian mahara-apache2_1.0.4-4+lenny3_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1 .0.4-4+lenny3_all.deb


• Debian mahara_1.0.4-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+l enny2_all.deb


• Debian mahara_1.0.4-4+lenny3_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+l enny3_all.deb

Debian Linux 5.0 alpha

• Debian mahara-apache2_1.0.4-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1 .0.4-4+lenny2_all.deb


• Debian mahara-apache2_1.0.4-4+lenny3_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1 .0.4-4+lenny3_all.deb


• Debian mahara_1.0.4-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+l enny2_all.deb


• Debian mahara_1.0.4-4+lenny3_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+l enny3_all.deb

Debian Linux 5.0 amd64

• Debian mahara-apache2_1.0.4-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1 .0.4-4+lenny2_all.deb


• Debian mahara-apache2_1.0.4-4+lenny3_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1 .0.4-4+lenny3_all.deb


• Debian mahara_1.0.4-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+l enny2_all.deb


• Debian mahara_1.0.4-4+lenny3_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+l enny3_all.deb

Debian Linux 5.0 ia-32

• Debian mahara-apache2_1.0.4-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1 .0.4-4+lenny2_all.deb


• Debian mahara-apache2_1.0.4-4+lenny3_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1 .0.4-4+lenny3_all.deb


• Debian mahara_1.0.4-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+l enny2_all.deb


• Debian mahara_1.0.4-4+lenny3_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+l enny3_all.deb

Debian Linux 5.0 mips

• Debian mahara-apache2_1.0.4-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1 .0.4-4+lenny2_all.deb


• Debian mahara-apache2_1.0.4-4+lenny3_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1 .0.4-4+lenny3_all.deb


• Debian mahara_1.0.4-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+l enny2_all.deb


• Debian mahara_1.0.4-4+lenny3_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+l enny3_all.deb

Debian Linux 5.0 s/390

• Debian mahara-apache2_1.0.4-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1 .0.4-4+lenny2_all.deb


• Debian mahara-apache2_1.0.4-4+lenny3_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1 .0.4-4+lenny3_all.deb


• Debian mahara_1.0.4-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+l enny2_all.deb


• Debian mahara_1.0.4-4+lenny3_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+l enny3_all.deb

Debian Linux 5.0 mipsel

• Debian mahara-apache2_1.0.4-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1 .0.4-4+lenny2_all.deb


• Debian mahara-apache2_1.0.4-4+lenny3_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1 .0.4-4+lenny3_all.deb


• Debian mahara_1.0.4-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+l enny2_all.deb


• Debian mahara_1.0.4-4+lenny3_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+l enny3_all.deb

Debian Linux 5.0 powerpc

• Debian mahara-apache2_1.0.4-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1 .0.4-4+lenny2_all.deb


• Debian mahara-apache2_1.0.4-4+lenny3_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1 .0.4-4+lenny3_all.deb


• Debian mahara_1.0.4-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+l enny2_all.deb


• Debian mahara_1.0.4-4+lenny3_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+l enny3_all.deb

Debian Linux 5.0 sparc

• Debian mahara-apache2_1.0.4-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1 .0.4-4+lenny2_all.deb


• Debian mahara-apache2_1.0.4-4+lenny3_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara-apache2_1 .0.4-4+lenny3_all.deb


• Debian mahara_1.0.4-4+lenny2_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+l enny2_all.deb


• Debian mahara_1.0.4-4+lenny3_all.deb
  http://security.debian.org/pool/updates/main/m/mahara/mahara_1.0.4-4+l enny3_all.deb

Mahara User Profile Cross Site Scripting Vulnerability

References:

• Mahara Homepage (Mahara)