PT-2007-3389 · Openads · Openads+1

Published 2007-04-16 · Updated 2011-03-08 · CVE-2007-2046

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Openads (phpAdsNew) versions 2.0.11 and earlier Openads for PostgreSQL (phpPgAds) versions 2.0.11 and earlier

Description The issue allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the dest parameter and the Referer HTTP header.

Recommendations For Openads (phpAdsNew) versions 2.0.11 and earlier, update to a version later than 2.0.11 to resolve the issue. For Openads for PostgreSQL (phpPgAds) versions 2.0.11 and earlier, update to a version later than 2.0.11 to resolve the issue. As a temporary workaround, consider restricting access to the adclick.php file and avoiding the use of the dest parameter in the affected API endpoint until a patch is available.

Fix

Related Identifiers

CVE-2007-2046

Affected Products

Openads

Openads For Postgresql

References · 6

• http://secunia.com/advisories/24876 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2046 · Security Note
• http://forum.openads.org/index.php?showtopic=503413399&pid=39136 · Patch
• http://sourceforge.net/project/shownotes.php?release_id=500343 · Note
• http://vupen.com/english/advisories/2007/1364 · Note
• http://sourceforge.net/forum/forum.php?forum_id=685278 · Note