16

Magento has released its security patch SUPEE-9652, for Magento 1.x CE and EE

I just want to know what are the possible problems after applying this security patch and What are the new changes in this security patch?

4 Answers 4

25

It's a super tiny patch, here's the diff:

diff --git lib/Zend/Mail/Transport/Sendmail.php lib/Zend/Mail/Transport/Sendmail.php
index b24026b..9323f58 100644
--- lib/Zend/Mail/Transport/Sendmail.php
+++ lib/Zend/Mail/Transport/Sendmail.php
@@ -119,14 +119,19 @@ class Zend_Mail_Transport_Sendmail extends Zend_Mail_Transport_Abstract
                 );
             }

-            set_error_handler(array($this, '_handleMailErrors'));
-            $result = mail(
-                $this->recipients,
-                $this->_mail->getSubject(),
-                $this->body,
-                $this->header,
-                $this->parameters);
-            restore_error_handler();
+            // Sanitize the From header
+            if (!Zend_Validate::is(str_replace(' ', '', $this->parameters), 'EmailAddress')) {
+                throw new Zend_Mail_Transport_Exception('Potential code injection in From header');
+            } else {
+                set_error_handler(array($this, '_handleMailErrors'));
+                $result = mail(
+                    $this->recipients,
+                    $this->_mail->getSubject(),
+                    $this->body,
+                    $this->header,
+                    $this->parameters);
+                restore_error_handler();
+            }
         }

         if ($this->_errstr !== null || !$result) {

However, Peter O'Callaghan (the one and only) seems to have found a bug. He gently shared the details with me and said I could share it with you here so here it is:

Best I can tell the value of $this->params will always be prefixed -f at the point the validation has been added (it’s passed into the constructor at the point the return path is added). Therefore at the point it’s passed to the validation, if I’ve configured my e-mail [email protected], the value that’s actually being validated is [email protected], it seems more of a fluke than an intention that this happens to validate as an e-mail address. If my e-mail address was "example"@example.com though, this would become -f"example"@example.com, which won’t validate. Incidentally the str_replace seems completely redundant in this matter given that AFAIK a space can only be used in conjunction with quotes, and e-mails with quotes won’t validate with the -f prefix. In fact if it wasn’t for the prefix being there, the str_replace and validate wouldn’t be useful because "foo bar"@example.com and "foobar"@example.com both validate, since the latter is never assigned to anything after the replacement, the e-mail would still be sent using the former value, which would presumably still be vulnerable.

Two other things to keep in mind:

Side note

The corresponding new release of Magento CE 1.9.3.2 also includes the copyright comment year update (from 2016 to 2017) so almost every files of Magento has been updated and the diff looks huge

10
  • 2
    "As long as you have the email settings disabled" which settings are these in the admin panel mate? Just to save me diving through Sys->Config without having had my coffee :) Feb 8, 2017 at 8:53
  • 2
    @LukeRodgers refer to this blog post for details: magento.com/security/news/… Feb 8, 2017 at 9:05
  • 1
    "copyright comment year update (from 2016 to 2017) so almost every files of Magento has been updated" that is truth @Raphael at Digital Pianism
    – Amit Bera
    Feb 8, 2017 at 18:12
  • 1
    @Icon well if you check the patch file name it's already v2 ^^ so possibly a v3 no ETA yet Feb 8, 2017 at 23:13
  • 1
    For the record, it's extremely unlikely to affect any legitimate use and AFAIK (without seeing the submitted payload), it would prevent exploitation in all cases (though the actual reason for this seems either unintentional, or an extremely odd choice). It's just that it blocks all e-mails where the local portion is quote encased, i.e."example"@example.com form addresses, regardless of whether they're technically dangerous. I'd be pretty surprised if there are any legit stores using this type of e-mail, but wanted the information available in-case. Feb 10, 2017 at 8:44
8

Little tip for upgrading; after copying the new version over your existing install, run git diff -w --stat=400 | grep -v " 2 +” to quickly see diffs that contain more changes than just the copyright notice change.

4

The Security Patch 9652 affects only the following file:

/lib/Zend/Mail/Transport/Sendmail.php
1

For those like me who wonder what to do without SSH access: edit file /lib/Zend/Mail/Transport/Sendmail.php

from line 122 onwards, replace this:

        set_error_handler(array($this, '_handleMailErrors'));
        $result = mail(
            $this->recipients,
            $this->_mail->getSubject(),
            $this->body,
            $this->header,
            $this->parameters);
        restore_error_handler();

with this:

        // Sanitize the From header
        if (!Zend_Validate::is(str_replace(' ', '', $this->parameters), 'EmailAddress')) {
            throw new Zend_Mail_Transport_Exception('Potential code injection in From header');
        } else {
            set_error_handler(array($this, '_handleMailErrors'));
            $result = mail(
                $this->recipients,
                $this->_mail->getSubject(),
                $this->body,
                $this->header,
                $this->parameters);
            restore_error_handler();
        }
2
  • 4
    hm, for those without SSH access. maybe you should patch locally and upload the patched file. ;)
    – infabo
    Feb 10, 2017 at 7:42
  • For full guidance on patching without SSH access, see this answer here: magento.stackexchange.com/a/63936/3326
    – 7ochem
    Feb 13, 2017 at 13:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.