4

I've just downloaded patch SUPEE-5344 and installed it, however the file name and applied.patches.list suggest it is SUPEE-5345, not 5344. OK this may be a typo in the code, perhaps, but checking my site with https://shoplift.byte.nl/scan still shows it still to be vulnerable.

How can I tell if this patch is the correct one and worked? Are there pre-requisites for this patch? (eg. 1533)

I'm running magento CE 1.7.0.2 and prior to this patch, none had been applied. Should I revert it and then get and apply ALL security patches available?

[later]

I reverted that original patch and applied 1533 then applied that patch again but still the test site shows it as vulnerable. File ownership was reset correctly and cache flushed (though I don't think that was necessary)

I note that the 1533 patch file is called PATCH_SUPEE-1533_EE_1.12.x_v1-2015-02-10-08-19-16.sh despite being downloaded for CE, not EE. Mind you, the patch list file suggests that 5344/5345 was for EE. How trustworthy are these patch files?

Improve this question
2
  • Those discrepancies on the shoplift.byte.nl scan are being noted over on the Magento community boards (yes, they reopened about a month ago). Seemingly fully patched and still vulnerable per the scan. I think somebody needs to contact byte.nl and ask what's up.
    – Fiasco Labs
    Commented Apr 22, 2015 at 16:18
  • You can be fully patched and vulnerable if you have not: 1) recompiled if you use the compiler, 2) flushed Magento cache after recompiling if applicable or after patching if not, 3) flushed your opcode caching (apc, opcache). Until the old code is flushed out of all caches, it is still active and you're still vulnerable.
    – Fiasco Labs
    Commented May 4, 2015 at 16:44

2 Answers 2

Reset to default
5

The file you installed is the correct file. The Patch is being collectively referred to as 5344, however the actual number of the patch appears to vary depending on which version of Magento you download it for. 1.7 is 5345, 1.6.1 is 5346, 1.6.x is 5341 etc.

I'm not sure why they did that for this patch, and yet keep the number consistent for 1533. Probably down to different employees with different opinions.

So long as you download the version matching your stores version, the patch appears in the app/etc/applied.patches file and you don't see any errors about the patch not applying when running, you should be good.

Improve this answer
2
  • Thanks for the reassurance though why does the shoplift.byte.nl/scan still show it to be vulnerable? I had a quick look at one of the patched modules and it seems to contain the new code and there's nothing untoward mentioned during the patching process nor in the patch listing file.
    – Ken
    Commented Apr 22, 2015 at 15:35
  • I honestly couldn't say. I'm not sure how their tool works for detecting the flaw and I'm unwilling to provide the admin frontname of any store I'm involved with to a third party site. So I couldn't tell you if I'm seeing the same behaviour. I can only suggest you check the things mentioned under 'I applied the patch but this site says I'm still vulnerable?'
    – Peter O'Callaghan
    Commented Apr 22, 2015 at 16:38
1

You can also check this patch installation using Magento's API. Just type the following request on a terminal window:

$ curl https://magento.com/security-patch-check/{domain}/{admin path}

Optionally, you can force the API to check in https mode: 

$ curl https://magento.com/security-patch-check/{domain}/{admin path}/https

You will get something like this

{"status":"ok","message":"SAFE: This site appears to be safe."}

OR 

{"status":"warning","message":"WARNING: This site appears to be vulnerable. Please patch it immediately!"}

source: http://magento.com/security-patch

Improve this answer
2
  • Despite having the required patches installed, the status comes back saying it's vulnerable. Trying on other magento sites I get variously that 'something went wrong' or 'could not connect to the site'
    – Ken
    Commented Apr 30, 2015 at 12:43
  • I would make sure to restart the server if you are getting the vulnerable even after applying the patch.
    – philcollin_us
    Commented Apr 30, 2015 at 20:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.