Slashdot Mirror
Critical Zen Cart Vulnerability Could Spell Black Friday Disaster For Shoppers (htbridge.com)
Mark Wilson writes: It's around this time of year, with Black Friday looming and Christmas just around the corner, that online sales boom. Today security firm High-Tech Bridge has issued a warning to retailers and shoppers about a critical vulnerability in the popular Zen Cart shopping management system. High-Tech Bridge has provided Zen Cart with full details of the security flaw which could allow remote attackers to infiltrate web servers and gain access to customer data. Servers running Zen Cart are also at risk of malware, meaning that hundreds of thousands of ecommerce sites pose a potential danger. Technical details of the vulnerability are not yet being made public, but having notified Zen Cart of the issue High-Tech Bridge says the date of full public disclosure is 16 December.
High-Tech assholes want to make a name for themselves. I bet they've been sitting on this just waiting for this time of year.
say something. don't ask, don't tell. bacon is bad. now what was that again?
Hack Friday ... amirite?
-- Brought to you by Carl's JR
I don't know about zen cart, but it's based on osCommerce which is a nasty piece of shit.
According to the original source (https://www.htbridge.com/advisory/HTB23282) the security issue affects versions 1.5.3 "and probably prior" (you gotta love the wording). When I looked at the Zen Cart site today v1.5.4 has been out for almost a year. Now someone else please take it from here...
And yet you continue to use the web...
We don't need to escape strings, because back in 2005 we wrote a regex that checks for SQL injection attacks. It worked with all five examples we threw at it, which is basically test driven development.
D-I-S-A-S-T-E-R
I sense much ass hurt from a php/MySQL developer.
Roast Turkey, of course.
Cryonics - Keep cool and carry on.
Zencart? How is a typical shopper supposed to know if the online retailer that they are using is using the Zencart system?
OK, I'll bite. What do you consider to be better than php?
Critical Zen Cart Vulnerability Could Spell Black Friday Disaster For Shoppers. This a great online sales boom. I really enjoy this post.
OK, I'll bite. What do you consider to be better than php?
I coded the payment system on our store's website in python CGI scripts. Keep it simple first. It helps that I'm a crypto security type engineer for a big techy company in my day job, so it's not a challenge to bake in defense in depth. It sucks when PCI-DSS scans ding you for insecure versions after their probe finds my honeypot.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
Defense in depth is, by definition, not simply "baked in". Don't kid yourself, what you did was only once piece of a very large puzzle.
Honeypots on a network with software that is running on the network is a vulnerability. Differing versions of the same software on a network can lead to leapfrogging, reflection, and worse. Imagine if someone knows full well it's a honeypot (outdated and new version on same network gives that away) they could compromise the honeypot, mimic the production server, then DOS the rest, email alerts and all. Then all your processing information is out the door.
The people that "dinged" you for your theatrics were right in doing so.
Too many assumptions here. Presumably the honeypot is full of false data delivering nonsense alerts to nowhere, and the owner is aware when it's compromised. That's what it's for. Of course, if you assume that hackers take over your entire data center at all 7 OSI layers, it really doesn't matter what defenses you have in place.
The honeypot is a simple way to identify an attack source. It's only one thing. As for any defense-in-depth structure, the failure of one thing doesn't compromise the whole. Preferably the failure of several things doesn't compromise the whole.
If you think there is anything to do with security in the PCI-DSS specs, you are sadly mistaken. They are a pile of poo.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
I coded the payment system on our store's website in python CGI scripts.
You can write secure code or insecure code in any language. You haven't shown anything that proves PHP itself is less secure than Python or Perl or ASP or $favorite_language.
I've written hundreds of thousands of lines of PHP and I put security as my primary concern. None of them have been hacked because I rigorously sanitize data and don't allow users to access things they shouldn't. Yes, it's a bit of a pain to try and cover every conceivable attack vector, but you can write secure code in PHP just as you can in any language. It's not the language, it's the implementation of the code you write.
Just cruising through this digital world at 33 1/3 rpm...
The Zen Cart code is a mess, and I'm not surprised that it has vulnerabilities.
XCart seems much better, but it's a monster codebase. It probably has some vulnerabilities too.
Just cruising through this digital world at 33 1/3 rpm...
Anything that doesn't actively encourage SQL injection attacks.
If you have to know the inner workings of a language API to avoid SQL injection attacks, it's crap.
I coded the payment system on our store's website in python CGI scripts.
You can write secure code or insecure code in any language. You haven't shown anything that proves PHP itself is less secure than Python or Perl or ASP or $favorite_language.
I've written hundreds of thousands of lines of PHP and I put security as my primary concern. None of them have been hacked because I rigorously sanitize data and don't allow users to access things they shouldn't. Yes, it's a bit of a pain to try and cover every conceivable attack vector, but you can write secure code in PHP just as you can in any language. It's not the language, it's the implementation of the code you write.
I was answering the question as asked, not filling in the details to satisfy your curiosity.
The relevant bit is attack surface and the reduction thereof, by doing things outside the memory space of the web server and passing all data through a well controlled pipe. You might be able to write secure code in PHP. But the language is largely irrelevant to the method of attack surface reduction I was employing that I was referring to, whereas CGI is. Old school, simple, separated.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
I am sure they just happened to discover the flaw at this time. It's not like they where sitting on the discovery, releasing the warning at maximum point of hysteria..
Could somebody post the original article that this post summarizes? e.g. Where can we get further information?
But the language is largely irrelevant to the method of attack surface reduction I was employing that I was referring to
And that was my point entirely.
Just cruising through this digital world at 33 1/3 rpm...
Because of this, or in spite of this, or regardless of this (choose one), I will not be doing any black Friday shopping. I choose not to commemorate the anniversary of the collapse of gold prices in the stock market.
If you are not allowed to question your government then the government has answered your question.
Do we have a choice? His point stands strong no matter what bullshit goof stooge incompetents like you webchumps say: Your shit blows.
you both said "webchumps", are you have a bout of schizophrenia again?
I want to own some retards running php
But the language is largely irrelevant to the method of attack surface reduction I was employing that I was referring to
And that was my point entirely.
But not a contradiction of mine, which is how you cast it.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
No panic... a patch is out already.
/ajax.php file has a vulnerability which can be used to cause a server exploit under very specific conditions.
/ajax.php file with the one attached below.
In Zen Cart v1.5.4 the
The patch is simple: replace the
https://www.zen-cart.com/showt...