12

Per the SWF / Flash vulnerability listed at: http://appcheck-ng.com/unpatched-vulnerabilites-in-magento-e-commerce-platform/

which I've verified does still exist in Magento 1.9.1.0, what is the best method to address this? Any issues with blocking or restricting access to these swf files?

| improve this question | |
  • 2
    According to Piotr Kaminski it was patched in 1.9.1.0. twitter.com/molotovbliss/status/537257580322488320 – B00MER Jan 8 '15 at 22:05
  • ok, I think I see why I thought 1.9.1.0 was still vulnerable. I tested it on a few Magento stores that upgraded from 1.9.0.1 and the file editor.swf (which is not used in 1.9.1.0) was still there from the older versions, so it still showed the alert. appcheck lists uploader.swf and uploaderSingle.swf as vulnerable, but I cannot get the alert to appear on any version using these files. I see 1.9.1.0 upgraded both the uploader swf files, so it does seem they are patched. For older 1.9.0.1 and older versions, is there a patch / workaround that can be used to mitigate risk besides upgrading? – Rob Mangiafico Jan 9 '15 at 2:22
  • You could try and replace the two .swf files and see if it doesn't break any functionality, if it does there may be code to be patched. Unfortunately it doesn't seem Magento has an official patch for it on older releases. – B00MER Jan 9 '15 at 2:28
10

This is probably not a 100% valid Stack Exchange answer as I cannot provide the full solution but I think it's better to post this than nothing.

There is a patch from Enterprise Support which solves the issue. I'm not allowed to publish the patch but if you are an Enterprise Customer you could ask for the patch as it is also compatible with some CE versions.

Here is some information which I hope I can share without getting in trouble:

The patch deletes two SWF files and modifies the uploader SWFs.

I was told the patch provided is compatible with these CE versions:

  • 1.4.*, 1.5.0.1, 1.6.0.0, 1.6.1.0, 1.7.0.0, 1.7.0.2, 1.8.0.0

Furthermore it is compatible with all EE versions < 1.14.0.0 so I guess the patch is included in EE 1.14. It would make sense that it's also included in CE 1.9 then.

[Update] I was informed by the support that the patch has been incorporated into CE 1.9.1. So the solution should be to either update to CE 1.9.1.0 or request this patch from Magento directly.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.