Magento eCommerce PHP Remote Code Execution
ma.ttias.be
Magento eCommerce PHP Remote Code Execution
1–10 of 81 posts
Re: Magento eCommerce PHP Remote Code Execution
#2Magento is pretty old school. Things like patching will be much easier in Magento 2, which uses Composer for managing dependencies.
Re: Magento eCommerce PHP Remote Code Execution
#3I smell the lawyers coming.
Re: Magento eCommerce PHP Remote Code Execution
#4This is hardly unique to Magento. Lots of applications do this. It's not ideal, but it's not SO bad if the application nags you to patch on start up. I don't use Magento, so I'm not sure if it does.
Re: Magento eCommerce PHP Remote Code Execution
#5This is hardly unique to Magento. Lots of applications do this. It's not ideal, but it's not SO bad if the application nags you to patch on start up. I don't use Magento, so I'm not sure if it does.
What's bad is that it's so easy to fix. It's the distribution platform for software. Shouldn't there be lots of interested people that could take 20 minutes and write some software to fix this problem?
Re: Magento eCommerce PHP Remote Code Execution
#6This is hardly unique to Magento. Lots of applications do this. It's not ideal, but it's not SO bad if the application nags you to patch on start up. I don't use Magento, so I'm not sure if it does.
It does, and looks like this, a screen filling alert view when you login into the backend. http://i.imgur.com/yeBKQIM.png
Re: Magento eCommerce PHP Remote Code Execution
#7I don't see the big fuss here if people are warned, either as the main package is downloaded or in the post-install configurations screens or in the admin screens, or ...
It comes down to how much time they can afford to spend on release testing for the OSS edition. They have tested the main release extensively, and have tested the patches too, but haven't had/made time to roll together a new full release and explicitly test that so continue to go with "install X, apply patches Y, Z, ..." as the process for new instances because that has been tested.
Full release regression testing can be a long-winded (and therefore potentially time expensive) process. Maybe people who have a problem with the current install process could club together and donate enough to make that worth while doing before the next planned full release...
(of course that is moot if people aren't warned adequately)
Re: Magento eCommerce PHP Remote Code Execution
#8Admin and developer of two Magento based sites here.
Magento has just started posting notifications of these vulnerabilities in their notification center. They sent two messages. One on April 16 and another on April 19. See images of message here http://imgur.com/a/edVGy they did inform us that a press release with the vulnerability was coming.
That said I am annoyed that the patch was from February 2015 and October 2014. If you do not go to this page https://www.magentocommerce.com/products/downloads/magento/ on a regular basis there is no way that I know of to get same day notification of new patches.
Re: Magento eCommerce PHP Remote Code Execution
#9This is hardly unique to Magento. Lots of applications do this. It's not ideal, but it's not SO bad if the application nags you to patch on start up. I don't use Magento, so I'm not sure if it does.
What's bad is that it's so easy to fix. It's the distribution platform for software . Shouldn't there be lots of interested people that could take 20 minutes and write some software to fix this problem?
But they did, didn't they? There's a security patch and they're nagging people to install it. What are they failing to do?
Re: Magento eCommerce PHP Remote Code Execution
#10Admin and developer of two Magento based sites here. Magento has just started posting notifications of these vulnerabilities in their notification center. They sent two messages. One on April 16 and another on April 19. See images of message here http://imgur.com/a/edVGy they did inform us that a press release with the vulnerability was coming. That said I am annoyed that the patch was from February 2015 and October…
One extra note for those who may run their Magento install on a shared host.
You will likely not be able to use the patch as is. It is distributed as .sh file that requires SSH and permissions that are not available on most shared hosts.
This is a serious shortfall of this patching method. You should create a trouble ticket with support and they should be able to run the patch scripts for you.