Openads versions 2.0.11 and below suffers from HTTP response splitting attacks.
53403817f5a46e40bb752ec4d5b071f12971a2957d3bc49af38869f853f922b5
========================================================================
Openads security advisory OPENADS-SA-2007-003
------------------------------------------------------------------------
Advisory ID: OPENADS-SA-2007-003
Date: 2007-Apr-11
Security risk: medium risk
Applications affetced: Openads, Openads for PostgreSQL
Versions affected: <= 2.0.11
Versions not affected: >= 2.0.11-pr1
========================================================================
========================================================================
Vulnerability: HTTP response splitting
========================================================================
Description
-----------
The adclick.php script is vulnerable to HTTP response splitting attacks
because the "dest" parameter is not properly sanitized.
The vulnerability DOES NOT affect those running PHP >= 4.4.2 or PHP >=
5.1.2, because the header function blocks this kind of attacks.
References
----------
- http://sla.ckers.org/forum/read.php?3,505,9508#msg-9508
Solution
--------
- Upgrade to Openads or Openads for PostgreSQL 2.0.11-pr1
Contact informations
====================
The security contact for Openads can be reached at:
<security AT openads DOT org>
Best regards
--
Matteo Beccati
http://www.openads.org
http://phpadsnew.com
http://phppgads.com