Bug 13369

Testing complete mga3 64

After installing the update, on the next visit it asks to perform the update, then checks the plugins. Scrolling to the bottom and clicking to continue does so without error and all is well after it completes.

Whiteboard: MGA3TOO has_procedure => MGA3TOO has_procedure mga3-64-ok

Sorry it was mga3 32 above.

Whiteboard: MGA3TOO has_procedure mga3-64-ok => MGA3TOO has_procedure mga3-32-ok

Testing complete mga3 64

Installed and updated but this time performed the installation with the testing version.

Whiteboard: MGA3TOO has_procedure mga3-32-ok => MGA3TOO has_procedure mga3-32-ok mga3-64-ok

Testing MGA4 64-bit real hardware.

The big update went fine; but I have forgotten the admin username & password, so might have to re-install it to actually try it. Grrr.

CC: (none) => lewyssmith

Re-installed [from Updates Testing] moodle-2.6.3-1.mga4. You need to:

- Create a MySQL/MariaDB database with:
CREATE DATABASE moodle DEFAULT CHARACTER SET UTF8 COLLATE utf8_unicode_ci;
GRANT SELECT,INSERT,UPDATE,DELETE,CREATE,CREATE TEMPORARY TABLES,DROP,INDEX,ALTER ON moodle.* TO moodleuser@localhost IDENTIFIED BY 'yourpassword';
with your choice of 'moodleuser' & 'yourpassword'. Note them both!

- Update /var/www/moodle/config.php
dbuser & dbpass with the MySQL/MariaDB user & password for the 'moodle' database.

To then launch Moodle on your local machine:
 http://localhost/moodle
The first time demands the administrator username (default 'admin') and very complicated password; be sure to note these permanently!

Very basic testing, setting the system up to the point of defining a naked course all seemed to work fine.

Whiteboard: MGA3TOO has_procedure mga3-32-ok mga3-64-ok => MGA3TOO has_procedure mga3-32-ok mga3-64-ok MGA4-64-OK

Well done Lewis.

Testing complete mga4 32 too

It's missing an advisory though David please.

Whiteboard: MGA3TOO has_procedure mga3-32-ok mga3-64-ok MGA4-64-OK => MGA3TOO has_procedure mga3-32-ok mga3-64-ok mga4-32-ok MGA4-64-OK

Thanks everyone.  I expect to have an advisory tomorrow.

Details on the issues fixed in this round of Moodle updates were released:
http://openwall.com/lists/oss-security/2014/05/19/1

Advisory:
========================

Updated moodle package fixes security vulnerabilities:

In Moodle before 2.6.3, Session checking was not being performed correctly
in Assignment's quick-grading, allowing forged requests to be made
unknowingly by authenticated users (CVE-2014-0213).

In Moodle before 2.6.3, MoodleMobile web service tokens, created
automatically in login/token.php, were not expiring and were valid forever
(CVE-2014-0214).

In Moodle before 2.6.3, Some student details, including identities, were
included in assignment marking pages and would have been revealed to
screen readers or through code inspection (CVE-2014-0215).

In Moodle before 2.6.3, Access to files linked on HTML blocks on the My
home page was not being checked in the correct context, allowing access to
unauthenticated users (CVE-2014-0216).

In Moodle before 2.6.3, There was a lack of filtering in the URL
downloader repository that could have been exploited for XSS
(CVE-2014-0218).

The 2.4 branch of Moodle will no longer be supported as of approximately
June 2014, so the Moodle package has been upgraded to version 2.6.3 to fix
these issues.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0213
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0214
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0215
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0216
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0218
https://moodle.org/mod/forum/discuss.php?d=260361
https://moodle.org/mod/forum/discuss.php?d=260362
https://moodle.org/mod/forum/discuss.php?d=260363
https://moodle.org/mod/forum/discuss.php?d=260364
https://moodle.org/mod/forum/discuss.php?d=260366
http://docs.moodle.org/dev/Moodle_2.4.10_release_notes
http://docs.moodle.org/dev/Moodle_2.6.3_release_notes

Thanks David, advisory uploaded.

Validating.

Could sysadmin please push to 3 & 4 updates

Thanks

Keywords: (none) => validated_update
Whiteboard: MGA3TOO has_procedure mga3-32-ok mga3-64-ok mga4-32-ok MGA4-64-OK => MGA3TOO has_procedure advisory mga3-32-ok mga3-64-ok mga4-32-ok MGA4-64-OK
CC: (none) => sysadmin-bugs

Update pushed:
http://advisories.mageia.org/MGASA-2014-0230.html

Status: NEW => RESOLVED
CC: (none) => tmb
Resolution: (none) => FIXED