Moodle Shibboleth Plugin 'auth/shibboleth/logout.php' Denial of Service Vulnerability

Bugtraq ID:	72653
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2015-0218
Remote:	Yes
Local:	No
Published:	Jan 19 2015 12:00AM
Updated:	Jan 19 2015 12:00AM
Credit:	Petr Skoda
Vulnerable:	Moodle Moodle 2.7.3 Moodle Moodle 2.7.2 Moodle Moodle 2.6.6 Moodle Moodle 2.6.5 Moodle Moodle 2.6.3 Moodle Moodle 2.6.2 Moodle Moodle 2.6.1 Moodle Moodle 2.8.1 Moodle Moodle 2.8 Moodle Moodle 2.7.1 Moodle Moodle 2.7 Moodle Moodle 2.6.4 Moodle Moodle 2.6
Not Vulnerable:	Moodle Moodle 2.8.2 Moodle Moodle 2.7.4 Moodle Moodle 2.6.7

Moodle Shibboleth Plugin 'auth/shibboleth/logout.php' Denial of Service Vulnerability

Moodle Shibboleth Plugin is prone to a denial-of-service vulnerability.

Attackers can exploit this issue to crash the affected application, denying service to legitimate users.

Moodle versions 2.8 through 2.8.1, 2.7 through 2.7.3, and 2.6 through 2.6.6 are vulnerable.

Moodle Shibboleth Plugin 'auth/shibboleth/logout.php' Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Moodle Shibboleth Plugin 'auth/shibboleth/logout.php' Denial of Service Vulnerability

References:

• Moodle Homepage (Moodle)
  
• MSA-15-0008: Forced logout through Shibboleth authentication plugin (Moodle)
  
• weekly release 2.9dev (Moodle)