PT-2007-3389 · Openads · Openads+1

Publicado 2007-04-16 · Atualizado 2011-03-08 · CVE-2007-2046

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Openads (phpAdsNew) versions 2.0.11 and earlier Openads for PostgreSQL (phpPgAds) versions 2.0.11 and earlier

Description The issue allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the dest parameter and the Referer HTTP header.

Recommendations For Openads (phpAdsNew) versions 2.0.11 and earlier, update to a version later than 2.0.11 to resolve the issue. For Openads for PostgreSQL (phpPgAds) versions 2.0.11 and earlier, update to a version later than 2.0.11 to resolve the issue. As a temporary workaround, consider restricting access to the adclick.php file and avoiding the use of the dest parameter in the affected API endpoint until a patch is available.

Correção

Identificadores relacionados

CVE-2007-2046

Produtos afetados

Openads

Openads For Postgresql

Referências · 6

• http://secunia.com/advisories/24876 · Aviso do Fabricante
• http://sourceforge.net/project/shownotes.php?release_id=500343 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2046 · Nota de Segurança
• http://vupen.com/english/advisories/2007/1364 · Nota
• http://forum.openads.org/index.php?showtopic=503413399&pid=39136 · Correção
• http://sourceforge.net/forum/forum.php?forum_id=685278 · Nota