Reading about those security risks, I wonder if there is something I can do for clients with 1.3 ce stores, where upgrade will require a new theme development.

  • I'm guessing that if you client isn't willing to upgrade Magento and stay in a very OLD version (let's face it), then that must mean they're not running a really big business, so why would someone bother trying to exploit these security risks ...? – Julien Lachal Apr 17 '15 at 15:03
  • 2
    @JulienLachal you should also consider automatic bots searching for out-dated systemse across the internet. I think it might come pretty soon with that exploit becoming more popular. It's never good to stay on so out-dated platform without applying proper patches. If theme is the only argument coming from clients I think adapting theme for newer version is not so much of a work to worry about comparing to cleaning up after someone's who exploited the shop. – versedi Apr 17 '15 at 15:49
  • Size doesn't matter, exploitability does. Expect automated scans for all versions. – Fiasco Labs Apr 18 '15 at 5:16

You can find patches for Magento CE versions 1.5.x and below for the SUPEE-5344 exploit on this website https://www.nublue.co.uk/blog/magento-remote-code-execution-bug-patches-for-pre-1-6-versions/. It should not be any trouble to patch.

  • 1
    I would strongly recommend to download these patches for versions 1.6 and up from the official website only: magentocommerce.com/products/downloads/magento – 7ochem Apr 18 '15 at 5:58
  • 1
    5344 and 1533 patches are also available for 1.4 and 1.5 on the official download page – 7ochem Apr 21 '15 at 10:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.