top | item 1697726

Using OpenX? Time to upgrade - Serious vulnerability found

25 points| sucuri2 | 15 years ago |blog.sucuri.net | reply

30 comments

order
[+] chrisbolt|15 years ago|reply
I got bitten by this too, and when I discovered why I was livid.

https://svn.openx.org/openx/tags/2.8/openx-2.8.6/plugins_rep...

This third party plugin is automatically installed and enabled by the installer. No admin authentication, wide open access to upload and run PHP.

More details can be found at http://www.kreativrauschen.com/blog/2010/09/09/critical-vuln... and if www/admin/plugins/videoReport/lib/tmp-upload-images/ exists, it's likely your server has been compromised.

[+] johng|15 years ago|reply
What version did this vulnerability first appear? I have some older installs that don't have an admin/plugins folder.
[+] DJN|15 years ago|reply
Dude, if u need a decent ad server as an alternative to OpenX, I'll suggest. Trafficspaces.

I designed it and it's one of my proudest pieces of work (if I may say so myself) :)

Warning: its a premium service

http://www.trafficspaces.com/tour/

[+] drtse4|15 years ago|reply
Even if i had a limited experience with it this doesn't surprise me, i still don't understand how big site can use or have used (list on openx site) this script to manage their own ad network.

Lots of issues with the db and with the upgrade procedure, sometimes has weird issues hard to identify and solve(i.e. things that stop working without any apparent reason)... Maybe i'm too critic, but i felt it was just another crappy php app.

[+] troels|15 years ago|reply
Notwithstanding that the code is a maze to find your way through.
[+] bobds|15 years ago|reply
This is particularly bad news when you couple it with the Flash vulnerability that's gonna be open for a few weeks.

You exploit a couple big OpenX installs, put some Flash ads in there and infect a whole lot of users.

On a sidenote, are there any less complex, preferably open-source, alternatives to OpenX?

[+] johng|15 years ago|reply
It's amazing to me that OpenX is trying to be looked at as a 'leader' in this space and they even do hosted ads, but they can't keep their servers up for a security patch release.
[+] JoelPM|15 years ago|reply
See my comment above - OpenX is being DDOS'ed. The upgrade didn't bring it down, though it's likely that the DDOS is intended to keep people from upgrading.
[+] drtse4|15 years ago|reply
As someone said below, alternatives are really limited, guess that's the result of inexistent competition.
[+] sucuri2|15 years ago|reply
Really bad, specially considering that openx.org has been offline for a while and we are seeing many attacks in the wild.
[+] JoelPM|15 years ago|reply
OpenX is being DDOS'ed, that's why the site is down.
[+] chopsueyar|15 years ago|reply
Has OpenX been suffering from security vulnerabilities for awhile now?
[+] bobf|15 years ago|reply
Yes, it seems that over the past 6-12 months it has been one security vulnerability after another with OpenX -- which is why I switched to Google DFP 2 weeks ago.
[+] chopsueyar|15 years ago|reply
What would be needed to create a secure equivelent of OpenX in terms of architecture and performance?

Is it more than a glorified image/snippet server and counter?

[+] chrisbolt|15 years ago|reply
It's slightly more complicated than that, and you'd probably have to work in advertising to understand why.

Ad zones, campaign weighting, frequency caps, companion positioning, exclusive campaigns, delivery limitations (language, user-agent, geographic targeting, time of day, section), probability calculation, detailed statistics, and the ability to give a client a login to view their own stats. These are just a few of the features.

If all you need is a glorified image/snippet server and counter, you could probably just write one.

[+] amalcon|15 years ago|reply
Their main site is down. Anyone want to enlighten the rest of us about what OpenX is? Something about ads, it seems; can anyone be more specific?
[+] sachinag|15 years ago|reply
It's an open source ad server.
[+] johng|15 years ago|reply
It's an adserver. Pretty simple.