Reading about those security risks, I wonder if there is something I can do for clients with 1.3 ce stores, where upgrade will require a new theme development.
-
I'm guessing that if you client isn't willing to upgrade Magento and stay in a very OLD version (let's face it), then that must mean they're not running a really big business, so why would someone bother trying to exploit these security risks ...?– Julien LachalCommented Apr 17, 2015 at 15:03
-
2@JulienLachal you should also consider automatic bots searching for out-dated systemse across the internet. I think it might come pretty soon with that exploit becoming more popular. It's never good to stay on so out-dated platform without applying proper patches. If theme is the only argument coming from clients I think adapting theme for newer version is not so much of a work to worry about comparing to cleaning up after someone's who exploited the shop.– versediCommented Apr 17, 2015 at 15:49
-
Size doesn't matter, exploitability does. Expect automated scans for all versions.– Fiasco LabsCommented Apr 18, 2015 at 5:16
Add a comment
|
1 Answer
You can find patches for Magento CE versions 1.5.x and below for the SUPEE-5344 exploit on this website https://www.nublue.co.uk/blog/magento-remote-code-execution-bug-patches-for-pre-1-6-versions/. It should not be any trouble to patch.
-
1I would strongly recommend to download these patches for versions 1.6 and up from the official website only: magentocommerce.com/products/downloads/magento– 7ochemCommented Apr 18, 2015 at 5:58
-
15344 and 1533 patches are also available for 1.4 and 1.5 on the official download page– 7ochemCommented Apr 21, 2015 at 10:37