Which EE and CE versions need the SUPEE-3762 patch to prevent DOS attack?

Question

It has been recently discovered that the SUPEE-3762 patch, released in August 2014 "accidently" fixed a Denial of Service exploit (see: https://www.byte.nl/blog/denial-of-service-flaw-in-magento)

Like many others we had ignored the patch because the original description did not contain this information and it was not labelled as security patch. It seemed to only fix a bug that was irrelevant if you were not using the SOAP API.

Now there is conflicting information about the versions that are affected.

• The blog post linked above states

  Only Magento 1.9.0.0 and 1.9.0.1 are affected

• The public download page currently offers only a patch for EE 1.14.0.1 (and nothing in the Enterprise download section):

  

• Two days ago, before the patch description has been updated, it was CE 1.6.x - 1.9.x not true, I had confused it with SUPEE-6237.

This leaves me with the questions

1. Is this still the same patch file? Is this the right patch file for Magento CE ?
2. Do I need to patch EE 1.14.1 shops?

(for now, I will go with the safe approach and add libxml_disable_entity_loader(false); to all index.php files, but I consider this a temporary fix)

Answer 1

The patch is no longer available because a more complete fix was included in SUPEE-6788. If you applied it, you should remove and install 6788.

Answer 2

If we see the section for the patch SUPEE-3762 there is a link given with it

"Note: please find details on this patch here."

When we go to that link it clearly mentiones

Note: Some of the patches discussed in this section have EE_1.14.0.1 in the name. These patches were all tested against CE 1.9.x as well.

I think we should rely on the official page information about this page.Even though Patch name may contain EE but Magento EE patches can be downloaded by enterprise edition customers only from my account section.

Please comment if I am wrong.

Answer 3

After patching an actual EE 1.14.0.1 instance, I could see that the following files were affected:

patching file lib/Zend/Soap/Server.php
patching file lib/Zend/Xml/Exception.php
patching file lib/Zend/Xml/Security.php

where lib/Zend/Xml is a new directory. This is not specific to Magento Enterprise and I could apply the same patch on CE 1.9.0.1.

However, Magento CE 1.9.1.0 as well as EE 1.14.1.0 already contain these changes. If you try to apply the patch on these versions, the output is:

Checking if patch can be applied/reverted successfully...
ERROR: Patch can't be applied/reverted successfully.

checking file lib/Zend/Soap/Server.php
Reversed (or previously applied) patch detected!  Assume -R? [n]
Apply anyway? [n]
Skipping patch.
2 out of 2 hunks ignored
The next patch would create the file lib/Zend/Xml/Exception.php,
which already exists!  Assume -R? [n]
Apply anyway? [n]
Skipping patch.
1 out of 1 hunk ignored
The next patch would create the file lib/Zend/Xml/Security.php,
which already exists!  Assume -R? [n]
Apply anyway? [n]
Skipping patch.
1 out of 1 hunk ignored

(that's fine, no action is needed)

Summary

PATCH_SUPEE-3762_EE_1.14.0.1_v1-2015-02-12-04-25-20.sh must be applied on EE 1.14.0.1 and CE 1.9.0.1 (and probably ..0.0 as well). All other versions do not need the patch.