4 replies to this topic

[kortshop]

I noticed that the hostingcompany domeneshop (www.domeneshop.no), will remove all oscommerce installations from their servers due to security issues.

"I senere tid har sikkerhetshull i osCommerce i økende og høy grad blitt utnyttet i automatisert angrep. Sikkerhetshullene brukes til skade på websidene som bruker osCommerce, angrep på besøkende på disse websidene, til spamming, og til angrep på andre websider og tjenester...."

in english:

Lately, an incrising number of automated attacks on osCommerce sites has been noticed. The security holes are beeing used to compromise the pages, for spam and for attackig other pages and services....

Comments on this issue? I know there is a number of security patches available but guess that most people are unable to apply these. Is this improved/removed with 2.3.1?

[toyicebear]

This is fixed in 2.3.1

or by doing the steps mentioned here for older versions

[flysouth]

I have several installations of 2.2 RC2 - and every one of them is getting hacked regularly - I have a number of so-called security fixes, but they do not appear to help!

Earlier versions of OSC did not seem to suffer from hacking so much - and I am not inclined to continue using this software any longer as it is too troublesome. Personally I do not believe that a myriad of fixes should be needed to achieve a reasonable measure of security.

2.3.1 does not appear to embody any major security fixes as far as I can see - I have no further use for this software and there surely must be something better!

[Jack_mcs]

flysouth, on 16 March 2011, 08:49, said:

I have several installations of 2.2 RC2 - and every one of them is getting hacked regularly - I have a number of so-called security fixes, but they do not appear to help!

Then you don't have the correct ones or your host is at fault.

Quote

Earlier versions of OSC did not seem to suffer from hacking so much - and I am not inclined to continue using this software any longer as it is too troublesome. Personally I do not believe that a myriad of fixes should be needed to achieve a reasonable measure of security.

LOL. Then you obviously don't use Windows.

Quote

2.3.1 does not appear to embody any major security fixes as far as I can see - I have no further use for this software and there surely must be something better!

RC2 is perfectly secure, when setup correctly. If you don't want to put in the effort, then, yes, you should try something else.

[eww]

A good host would tell you what to do to remain secure, not tell you to bounce from software to software.
A similar post: http://forums.oscommerce.com/topic/372587-oscommerce-is-not-a-good-option/page__p__1572216#entry1572216