BugTraq
[OPENX-SA-2009-002] OpenX 2.4.11, 2.6.5, 2.8.0 fix multiple vulnerabilities Apr 01 2009 10:33PM
Matteo Beccati (php beccati com)
========================================================================

OpenX security advisory OPENX-SA-2009-002
------------------------------------------------------------------------

Advisory ID: OPENX-SA-2009-002
Date: 2009-Apr-01
Security risk: Critical
Applications affetced: OpenX
Versions affected: <= 2.4.10, <= 2.6.4, <= 2.7.29-beta
Versions not affected: >= 2.4.11, >= 2.6.5, >= 2.8.0
========================================================================

========================================================================

Multiple vulnerabilities Discovered by Sandro Gauci
========================================================================

Description
-----------
A security review was recently being conducted on Openx 2.6.4 by Sandro
Gauci. As part of the review he reported the following vulnerabilities:

- SQL injection in adview.php and other delivery scripts because of
missing or improper validation of the "OAID" cookie;
- SQL injection in tjs.php because of missing or improper validation
of the "referer" GET parameter;
- XSS vulnerability in sso-accounts.php because of missing or improper
validation of the "email" GET parameter (2.4.x not affected)
- Possible arbitrary file deletion in tjs.php via the "trackerid" GET
parameter
- Possible CRLF injection in various delivery files because of missing
sanitisation of parameters (PHP 4.4.2 or 5.1.2 and follwing versions
are not affected)
- Possible arbitrary file deletion in various delivery scripts

Both the SQL injection vulnerabilities can be remotely exploited by
unauthenticated attackers: upgrading is strongly advised.

References
----------
https://developer.openx.org/jira/browse/OX-4867
http://resources.enablesecurity.com/advisories/openx-2.6.4-multiple.txt

========================================================================

Vulnerabilites previously repoted by Secunia
========================================================================

Description
-----------
A security review was previously conducted by Sarid Harper on behalf of
Secunia and led to the release of OpenX 2.4.10 and 2.6.4 fo fix a number
of vulnerabilities. He recently reported that OpenX 2.6.4 was still
vulnerable to two of them and they have been properly fixed now:

- Input passed to the "userid" parameter in "www/admin/admin-user.php"
is not properly sanitised before being returned to the user. This can
be exploited to execute arbitrary HTML and script code in a user's
browser session in the context of an affected site (#9)
- Input passed to the "agencyid" parameter in
"www/admin/agency-edit.php" is not properly sanitised before being
returned to the user. This can be exploited to execute arbitrary
HTML and script code in a user's browser session in the context of
an affected site (#11)

References
----------
http://secunia.com/advisories/32197/
https://developer.openx.org/jira/browse/OX-4803
https://developer.openx.org/jira/browse/OX-4805
https://developer.openx.org/jira/browse/OX-4957

========================================================================

Multiple SQL injections and XSS vulnerabilities
========================================================================

Description
-----------
A security review was internally performed following Secunia's report.
A number of XSS vulnerabilities were found and fixed, plus several SQL
injection vulnerabilities:

- SQL injection in userlog-index.php via the "advertiserId" parameter
- SQL injection in channel-edit.php via the "affiliateid" parameter
- SQL injection in banner-zone.php via the "bannerid" parameter

All require authentication to be exploited.

References
----------
https://developer.openx.org/jira/browse/OX-4826

Solution
========

We stronly advise people running affected versions to upgrade to the
most recent versions of OpenX: 2.4.11, 2.6.5 or 2.8.0.

Contact informations
====================

The security contact for OpenX can be reached at:
<security AT openx DOT org>

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus