Zero Day Vulnerability in OpenX Source 2.8.11 and Revive Adserver 3.0.1

If you are using OpenX or the new Revive Adserver (fork of OpenX), you need to update it ASAP. Florian Sander discovered a serious SQL injection vulnerability that affects all versions of OpenX and all versions of the Revive Adserver. From the Revive advisory:

An SQL-injection vulnerability was recently discovered and reported to the Revive Adserver team by Florian Sander.

The vulnerability is known to be already exploited to gain unauthorized access to the application using brute force mechanisms, however other kind of attacks might be possible and/or already in use. The risk is rated to be critical as the most common end goal of the attackers is to spread malware to the visitors of all the websites and ad networks that the ad server is being used on.

The vulnerability is also present and exploitable in OpenX Source 2.8.11 and earlier versions, potentially back to phpAdsNew 2.0.x.

The XML-RPC delivery invocation script was failing to escape its input parameters in the same way the other delivery methods do, allowing attackers to inject arbitrary SQL code via the “what” parameter of the delivery XML-RPC methods. Also, the escaping technique used to handle such parameter in the delivery scripts was based on the addslashes PHP function and has now been upgraded to use the dedicated escaping functions for the database in use.

We highly recommend anyone using OpenX to upgrade to the latest Revive version, or as a temporary fix, remove the file “www/delivery/axmlrpc.php” from your installation.

Clients using our CloudProxy Website Firewall are already protected against it. If you want to protect your OpenX / Revive install, you can sign up for CloudProxy here. Compromised and Downloads Injected with a Backdoor

We received reports that was compromised and the OpenX download files had a backdoor injected in them. According to Heise (in German), the malicious files were modified around November/2012, and have been undetected since.

It means that if you have downloaded OpenX during the last 7 months, it likely contains a backdoor that could allow the attackers full access to your site. That’s how serious it is.

*The OpenX team have confirmed the breach and removed the bad files from their servers.

Read More serving malware?

We are tracking a few sites that are currently blacklisted and showing a warning from Google that (home of a popular open source ad server) is the site responsible for the infection:

2 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including

By looking at the diagnostic page for itself, it shows:

Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, appeared to function as an intermediary for the infection of 82 site(s) including,,

We are still tracking to see which ads are causing the issue, or if the openx servers themselves are compromised. If you include the tracking code from, we recommend that you check to see if there isn’t any malicious code being pushed to your users.

OpenX users – Time to upgrade

*Note that is currently offline, so we recommend disabling it until you can upgrade.
**We are mirroring version 2.8.7 here: if you don’t want to wait until openx is back online.
***If your site is hacked/blacklisted and you need help, email us at

If you are using OpenX, make sure to upgrade it to the latest version (2.8.7) as soon as possible.

Older versions have a known vulnerability that is being exploited in the wild.

This is the announcement from the OpenX team (their site is offline, so I am copying in here):

Security is an important priority at OpenX and we’re constantly working to provide security patches and bug fixes as soon as we become aware of any potential issue. As these issues are discovered, we validate, patch and release as quickly as we can. But it’s important to understand that avoiding potential security issues also requires server administrators to be vigilant and upgrade their systems to new, patched versions as soon as they become available.

It has been brought to our attention that there is a vulnerability in the 2.8 downloadable version of OpenX that can result in a server running the downloaded version of OpenX being compromised. We have already closed this vulnerability with the latest version of our software. To avoid this issue, we recommend that all users immediately upgrade their systems to 2.8.7.

You can download the new version here: (also offline, but hopefully it will be back soon).

Example of malware being used in the wild:

If you can’t upgrade, make sure to delete the following file: admin/plugins/videoReport/lib/ofc2/ofc_upload_image.php

We will post more details as we learn.
Read More

ASIS International Website Blacklisted by Google

The official website ( of ASIS International, a major physical security association was hacked and blacklisted yesterday. Add another case to the list of sites using outdated and/or vulnerable applications. In the case of ASIS, they were running a vulnerable version of OpenX (ad server software) and the attackers injected malicious code in there.

Anyone visiting the ASIS website has ads served from which is the culprit. The ad server is loading malware from: hxxp:// The malware string can be detected using our scanner.

Read More