CVE-2011-4302: Input Validation

Published Jul 11, 2012

Updated

mnet/xmlrpc/client.php in MNET in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not properly process the return value of the opensslverify function, which allows remote attackers to bypass validation via a crafted certificate.

Affected Software

19 affected components

Moodle moodle=2.0.2

Moodle moodle=1.9.4

Moodle moodle=1.9.6

Moodle moodle=1.9.9

Moodle moodle=2.0.1

Moodle moodle=1.9.11

Moodle moodle=2.0.4

Moodle moodle=1.9.2

Moodle moodle=1.9.12

Moodle moodle=1.9.10

Moodle moodle=2.0.3

Moodle moodle=2.1.1

Moodle moodle=1.9.3

Moodle moodle=1.9.13

Moodle moodle=1.9.5

Moodle moodle=1.9.8

Moodle moodle=1.9.7

Moodle moodle=2.0.0

Moodle moodle=2.1.0

Remediation

Patch Available

https://bugzilla.redhat.com/show_bug.cgi?id=747444

Event History

Jul 11, 2012

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2011-4302?

CVE-2011-4302 has a moderate severity rating as it allows remote attackers to bypass certificate validation.

How do I fix CVE-2011-4302?

To fix CVE-2011-4302, you should upgrade to Moodle version 1.9.14, 2.0.5, or 2.1.2 or later.

What versions of Moodle are affected by CVE-2011-4302?

CVE-2011-4302 affects Moodle versions 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2.

What type of attack can exploit CVE-2011-4302?

CVE-2011-4302 can be exploited by attackers who use a crafted certificate to bypass Openssl verification.

Is CVE-2011-4302 specific to certain operating systems?

CVE-2011-4302 is specific to Moodle installations and is not limited to a particular operating system.