4

It has been recently discovered that the SUPEE-3762 patch, released in August 2014 "accidently" fixed a Denial of Service exploit (see: https://www.byte.nl/blog/denial-of-service-flaw-in-magento)

Like many others we had ignored the patch because the original description did not contain this information and it was not labelled as security patch. It seemed to only fix a bug that was irrelevant if you were not using the SOAP API.

Now there is conflicting information about the versions that are affected.

  • The blog post linked above states

    Only Magento 1.9.0.0 and 1.9.0.1 are affected

  • The public download page currently offers only a patch for EE 1.14.0.1 (and nothing in the Enterprise download section):

    Screnshot

  • Two days ago, before the patch description has been updated, it was CE 1.6.x - 1.9.x not true, I had confused it with SUPEE-6237.

This leaves me with the questions

  1. Is this still the same patch file? Is this the right patch file for Magento CE ?
  2. Do I need to patch EE 1.14.1 shops?

(for now, I will go with the safe approach and add libxml_disable_entity_loader(false); to all index.php files, but I consider this a temporary fix)

1

The patch is no longer available because a more complete fix was included in SUPEE-6788. If you applied it, you should remove and install 6788.

1

If we see the section for the patch SUPEE-3762 there is a link given with it

"Note: please find details on this patch here."

When we go to that link it clearly mentiones

Note: Some of the patches discussed in this section have EE_1.14.0.1 in the name. These patches were all tested against CE 1.9.x as well.

enter image description here

I think we should rely on the official page information about this page.Even though Patch name may contain EE but Magento EE patches can be downloaded by enterprise edition customers only from my account section.

Please comment if I am wrong.

  • Thanks, this makes sense. The patch file does not seem to address enterprise specific files. – Fabian Schmengler Sep 3 '15 at 9:18
  • @fschmengler If my answer provides correct information related to your question, could you please accept it. – Mukesh Sep 3 '15 at 9:25
  • I was waiting for more/official answers, but heck, why not, I figured it out. :) – Fabian Schmengler Sep 3 '15 at 9:28
1

After patching an actual EE 1.14.0.1 instance, I could see that the following files were affected:

patching file lib/Zend/Soap/Server.php
patching file lib/Zend/Xml/Exception.php
patching file lib/Zend/Xml/Security.php

where lib/Zend/Xml is a new directory. This is not specific to Magento Enterprise and I could apply the same patch on CE 1.9.0.1.

However, Magento CE 1.9.1.0 as well as EE 1.14.1.0 already contain these changes. If you try to apply the patch on these versions, the output is:

Checking if patch can be applied/reverted successfully...
ERROR: Patch can't be applied/reverted successfully.

checking file lib/Zend/Soap/Server.php
Reversed (or previously applied) patch detected!  Assume -R? [n]
Apply anyway? [n]
Skipping patch.
2 out of 2 hunks ignored
The next patch would create the file lib/Zend/Xml/Exception.php,
which already exists!  Assume -R? [n]
Apply anyway? [n]
Skipping patch.
1 out of 1 hunk ignored
The next patch would create the file lib/Zend/Xml/Security.php,
which already exists!  Assume -R? [n]
Apply anyway? [n]
Skipping patch.
1 out of 1 hunk ignored

(that's fine, no action is needed)

Summary

PATCH_SUPEE-3762_EE_1.14.0.1_v1-2015-02-12-04-25-20.sh must be applied on EE 1.14.0.1 and CE 1.9.0.1 (and probably ..0.0 as well). All other versions do not need the patch.

  • Where can I get this patch. The Magento site mentions the patch but doesn't provide a download possibility... – Badger Jan 12 '16 at 9:31
  • Good question. It was there before. – Fabian Schmengler Jan 12 '16 at 9:45
  • I did find it on another site, but I'm curious as to why it's not available on the Magento site – Badger Jan 12 '16 at 10:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.