bugtraq - [OPENADS-SA-2008-001] Openads 2.4.2 vulnerability fixed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 04 Feb 2008 18:47:53 +0100
From: Matteo Beccati <php@...cati.com>
To: bugtraq@...urityfocus.com
Cc: full-disclosure@...ts.grok.org.uk
Subject: [OPENADS-SA-2008-001] Openads 2.4.2 vulnerability fixed

========================================================================
Openads security advisory                            OPENADS-SA-2008-001
------------------------------------------------------------------------
Advisory ID:           OPENADS-SA-2008-001
Date:                  2008-Feb-04
Security risk:         Critical
Applications affetced: Openads
Versions affected:     2.4.0 <= x <= 2.4.2
Versions not affected: >= 2.4.3
========================================================================


========================================================================
Vulnerability:  Remote PHP code injection and execution
========================================================================

Description
-----------
A remote PHP code injection and execution vulnerability has recently
been found. The vulnerability affects the delivery engine, which does
not require any kind of authentication. An attacker could exploit it to
execute arbitrary PHP code.

Solution
--------
  - Upgrade to Openads 2.4.3

Credits
-------
  - Reporter: Tanatik


Contact informations
====================

The security contact for Openads can be reached at:
<security AT openads DOT org>


Best regards
--
Matteo Beccati
http://www.openads.org