[OPENX-SA-2009-002] OpenX 2.4.11, 2.6.5, 2.8.0 fix multiple vulnerabilities

[Matteo Beccati <php@xxxxxxxxxxx>]

========================================================================
OpenX security advisory                                OPENX-SA-2009-002
------------------------------------------------------------------------
Advisory ID:           OPENX-SA-2009-002
Date:                  2009-Apr-01
Security risk:         Critical
Applications affetced: OpenX
Versions affected:     <= 2.4.10, <= 2.6.4, <= 2.7.29-beta
Versions not affected: >= 2.4.11, >= 2.6.5, >= 2.8.0
========================================================================


========================================================================
Multiple vulnerabilities Discovered by Sandro Gauci
========================================================================

Description
-----------
A security review was recently being conducted on Openx 2.6.4 by Sandro
Gauci. As part of the review he reported the following vulnerabilities:

 - SQL injection in adview.php and other delivery scripts because of
  missing or improper validation of the "OAID" cookie;
 - SQL injection in tjs.php because of missing or improper validation
  of the "referer" GET parameter;
 - XSS vulnerability in sso-accounts.php because of missing or improper
  validation of the "email" GET parameter (2.4.x not affected)
 - Possible arbitrary file deletion in tjs.php via the "trackerid" GET
  parameter
 - Possible CRLF injection in various delivery files because of missing
  sanitisation of parameters (PHP 4.4.2 or 5.1.2 and follwing versions
  are not affected)
 - Possible arbitrary file deletion in various delivery scripts

Both the SQL injection vulnerabilities can be remotely exploited by
unauthenticated attackers: upgrading is strongly advised.

References
----------
https://developer.openx.org/jira/browse/OX-4867
http://resources.enablesecurity.com/advisories/openx-2.6.4-multiple.txt


========================================================================
Vulnerabilites previously repoted by Secunia
========================================================================

Description
-----------
A security review was previously conducted by Sarid Harper on behalf of
Secunia and led to the release of OpenX 2.4.10 and 2.6.4 fo fix a number
of vulnerabilities. He recently reported that OpenX 2.6.4 was still
vulnerable to two of them and they have been properly fixed now:

 - Input passed to the "userid" parameter in "www/admin/admin-user.php"
  is not properly sanitised before being returned to the user. This can
  be exploited to execute arbitrary HTML and script code in a user's
  browser session in the context of an affected site (#9)
 - Input passed to the "agencyid" parameter in
  "www/admin/agency-edit.php" is not properly sanitised before being
  returned to the user. This can be exploited to execute arbitrary
  HTML and script code in a user's browser session in the context of
  an affected site (#11)

References
----------
http://secunia.com/advisories/32197/
https://developer.openx.org/jira/browse/OX-4803
https://developer.openx.org/jira/browse/OX-4805
https://developer.openx.org/jira/browse/OX-4957


========================================================================
Multiple SQL injections and XSS vulnerabilities
========================================================================

Description
-----------
A security review was internally performed following Secunia's report.
A number of XSS vulnerabilities were found and fixed, plus several SQL
injection vulnerabilities:

 - SQL injection in userlog-index.php via the "advertiserId" parameter
 - SQL injection in channel-edit.php via the "affiliateid" parameter
 - SQL injection in banner-zone.php via the "bannerid" parameter

All require authentication to be exploited.



References
----------
https://developer.openx.org/jira/browse/OX-4826



Solution
========

We stronly advise people running affected versions to upgrade to the
most recent versions of OpenX: 2.4.11, 2.6.5 or 2.8.0.


Contact informations
====================

The security contact for OpenX can be reached at:
<security AT openx DOT org>