16

Magento has released its security patch SUPEE-9652, for Magento 1.x CE and EE

I just want to know what are the possible problems after applying this security patch and What are the new changes in this security patch?

25

It's a super tiny patch, here's the diff:

diff --git lib/Zend/Mail/Transport/Sendmail.php lib/Zend/Mail/Transport/Sendmail.php
index b24026b..9323f58 100644
--- lib/Zend/Mail/Transport/Sendmail.php
+++ lib/Zend/Mail/Transport/Sendmail.php
@@ -119,14 +119,19 @@ class Zend_Mail_Transport_Sendmail extends Zend_Mail_Transport_Abstract
                 );
             }

-            set_error_handler(array($this, '_handleMailErrors'));
-            $result = mail(
-                $this->recipients,
-                $this->_mail->getSubject(),
-                $this->body,
-                $this->header,
-                $this->parameters);
-            restore_error_handler();
+            // Sanitize the From header
+            if (!Zend_Validate::is(str_replace(' ', '', $this->parameters), 'EmailAddress')) {
+                throw new Zend_Mail_Transport_Exception('Potential code injection in From header');
+            } else {
+                set_error_handler(array($this, '_handleMailErrors'));
+                $result = mail(
+                    $this->recipients,
+                    $this->_mail->getSubject(),
+                    $this->body,
+                    $this->header,
+                    $this->parameters);
+                restore_error_handler();
+            }
         }

         if ($this->_errstr !== null || !$result) {

However, Peter O'Callaghan (the one and only) seems to have found a bug. He gently shared the details with me and said I could share it with you here so here it is:

Best I can tell the value of $this->params will always be prefixed -f at the point the validation has been added (it’s passed into the constructor at the point the return path is added). Therefore at the point it’s passed to the validation, if I’ve configured my e-mail contact@me.com, the value that’s actually being validated is -fcontact@me.com, it seems more of a fluke than an intention that this happens to validate as an e-mail address. If my e-mail address was "example"@example.com though, this would become -f"example"@example.com, which won’t validate. Incidentally the str_replace seems completely redundant in this matter given that AFAIK a space can only be used in conjunction with quotes, and e-mails with quotes won’t validate with the -f prefix. In fact if it wasn’t for the prefix being there, the str_replace and validate wouldn’t be useful because "foo bar"@example.com and "foobar"@example.com both validate, since the latter is never assigned to anything after the replacement, the e-mail would still be sent using the former value, which would presumably still be vulnerable.

Two other things to keep in mind:

Side note

The corresponding new release of Magento CE 1.9.3.2 also includes the copyright comment year update (from 2016 to 2017) so almost every files of Magento has been updated and the diff looks huge

  • 2
    "As long as you have the email settings disabled" which settings are these in the admin panel mate? Just to save me diving through Sys->Config without having had my coffee :) – Luke Rodgers Feb 8 '17 at 8:53
  • 2
    @LukeRodgers refer to this blog post for details: magento.com/security/news/… – Raphael at Digital Pianism Feb 8 '17 at 9:05
  • 1
    "copyright comment year update (from 2016 to 2017) so almost every files of Magento has been updated" that is truth @Raphael at Digital Pianism – Amit Bera Feb 8 '17 at 18:12
  • 1
    @Icon well if you check the patch file name it's already v2 ^^ so possibly a v3 no ETA yet – Raphael at Digital Pianism Feb 8 '17 at 23:13
  • 1
    For the record, it's extremely unlikely to affect any legitimate use and AFAIK (without seeing the submitted payload), it would prevent exploitation in all cases (though the actual reason for this seems either unintentional, or an extremely odd choice). It's just that it blocks all e-mails where the local portion is quote encased, i.e."example"@example.com form addresses, regardless of whether they're technically dangerous. I'd be pretty surprised if there are any legit stores using this type of e-mail, but wanted the information available in-case. – Peter O'Callaghan Feb 10 '17 at 8:44
8

Little tip for upgrading; after copying the new version over your existing install, run git diff -w --stat=400 | grep -v " 2 +” to quickly see diffs that contain more changes than just the copyright notice change.

4

The Security Patch 9652 affects only the following file:

/lib/Zend/Mail/Transport/Sendmail.php
1

For those like me who wonder what to do without SSH access: edit file /lib/Zend/Mail/Transport/Sendmail.php

from line 122 onwards, replace this:

        set_error_handler(array($this, '_handleMailErrors'));
        $result = mail(
            $this->recipients,
            $this->_mail->getSubject(),
            $this->body,
            $this->header,
            $this->parameters);
        restore_error_handler();

with this:

        // Sanitize the From header
        if (!Zend_Validate::is(str_replace(' ', '', $this->parameters), 'EmailAddress')) {
            throw new Zend_Mail_Transport_Exception('Potential code injection in From header');
        } else {
            set_error_handler(array($this, '_handleMailErrors'));
            $result = mail(
                $this->recipients,
                $this->_mail->getSubject(),
                $this->body,
                $this->header,
                $this->parameters);
            restore_error_handler();
        }
  • 4
    hm, for those without SSH access. maybe you should patch locally and upload the patched file. ;) – infabo Feb 10 '17 at 7:42
  • For full guidance on patching without SSH access, see this answer here: magento.stackexchange.com/a/63936/3326 – 7ochem Feb 13 '17 at 13:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.