7

What are the technical vulnerability which are covered by the critical vulnerability (SC2016-001-128003)? The KB article doesn't cover what the vulnerability is.

Improve this question
6
  • 2
    I do agree, however, it might be relevant for everyone running older versions of Sitecore. From that perspective, the explanation here can be very relevant for a broad audience - they might be triggered to upgrade/patch their environment based on this information
    – Bas Lijten
    Oct 18, 2016 at 8:03
  • 3
    Why on earth has this been deemed off-topic? If we cannot discuss vulnerabilities on a site like SE, then what is the use? I'm not saying we should publish ready-to-run exploitation code, but to discuss the technical impact of a 0-day exploit, and the possible functional degradation of the hotfix is IMHO what this site is for (amongst other topics of course).
    – Sune Rievers
    Oct 18, 2016 at 9:07
  • 2
    The vulnerability is labelled "Critical" - as in "Allows unauthorized code execution on target environment". That really is all, anyone should need to know. Given that this is a 0 day vulnerability that by and large has not been patched anywhere yet - discussing the inner workings and details, how to exploit it etc, is inappropriate. For this site and any site.
    – Mark Cassidy ♦
    Oct 18, 2016 at 9:15
  • 1
    That said - it is the first time we've dealt with this particular type of question - the community has yet to agree on a standard on this subject. Right now I think the consensus is, to "err on the side of caution" - until we've had time to debate how we want to deal with these questions moving forward.
    – Mark Cassidy ♦
    Oct 18, 2016 at 9:17
  • 3
    I have raised this as a discussion on meta. meta.sitecore.stackexchange.com/questions/116/…
    – Mark Cassidy ♦
    Oct 18, 2016 at 9:25

1 Answer 1

Reset to default
12

Update: I have removed technical details about the vulnerability, since it is still present on many Sitecore installations world-wide.

The Quick-and-Dirty fix

If you want to remove the vulnerability quickly and without restarting your Sitecore instances, just delete PushSession.ashx—it's used very rarely anyway, and only in multi-cluster setups. You can apply the full fix later.

Improve this answer
2
  • 1
    Who can call it? Is it filtered by anything or is it just open to the world?
    – Vicent Galiana
    Oct 18, 2016 at 7:47
  • @VicentGaliana It is open.
    – Dmytro Shevchenko
    Oct 18, 2016 at 7:50

Not the answer you're looking for? Browse other questions tagged or ask your own question.