Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:16700
HistoryApr 13, 2007 - 12:00 a.m.

[Full-disclosure] [OPENADS-SA-2007-003] Openads 2.0.11 vulnerability fixed

2007-04-1300:00:00
vulners.com
60

========================================================================
Openads security advisory OPENADS-SA-2007-003

Advisory ID: OPENADS-SA-2007-003
Date: 2007-Apr-11
Security risk: medium risk
Applications affetced: Openads, Openads for PostgreSQL
Versions affected: <= 2.0.11
Versions not affected: >= 2.0.11-pr1

========================================================================
Vulnerability: HTTP response splitting

Description

The adclick.php script is vulnerable to HTTP response splitting attacks
because the "dest" parameter is not properly sanitized.

The vulnerability DOES NOT affect those running PHP >= 4.4.2 or PHP >=
5.1.2, because the header function blocks this kind of attacks.

References

Solution

  • Upgrade to Openads or Openads for PostgreSQL 2.0.11-pr1

Contact informations

The security contact for Openads can be reached at:
<security AT openads DOT org>

Best regards

Matteo Beccati
http://www.openads.org
http://phpadsnew.com
http://phppgads.com


Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/