SEP 03 2015

How to apply SUPEE-3762 without SSH

August 31, 2015: We are receiving notices about attacks to Magento stores via /index.php/api/v2_soap/index/ URL exploiting issue in Zend Framework used in and versions. Attacks are coming from network block (Digitalocean) and user-agent logged as [email protected].
If you run Magento or version it is strongly recommended to apply SUPEE-3762 patch or upgrade to the latest Magento version. If you wish to save time and have us to install these patches for you, simply click here to order installation. If you have no SSH access to apply the patch, you can simply upgrade your installation to Magento version which includes all the latest security patches (SUPEE-5344, SUPEE-5994, SUPEE-6285, SUPEE-6482). If Magento upgrade is not possible in the moment due to some reason you still can apply the patch via FTP/sFTP upload as shown in this article. SUPEE-3762 patch can be installed independently, prior to or after installation of other security patches (SUPEE-1533, SUPEE-5344, SUPEE-5994 or SUPEE-6285). The following files are changed by SUPEE-3762:
  • lib/Zend/Soap/Server.php
  • lib/Zend/Xml/Exception.php
  • lib/Zend/Xml/Security.php

Applying Magento patches via FTP/sFTP or FileManager / File Upload

To apply patches in this way we simply replace changed files. This way can not be used blindly if you or your developers have changed any core Magento files (which is a big no-no, by the way). Such changes should be re-applied to patched files, or you loose these changes. Before patching make sure to Disable Magento Compiler if you use it and clear compiled cache. Patched version of these files for Magento and packed into single ZIP archive:
Magento versionSUPEE-3762

If you use PHP opcode caches (APC/XCache/eAccelerator) make sure to flush it (or restart webserver) after patching, otherwise code will continue to run from caches. Additionally, if your store still using default /admin/ path, you may consider securing your Magento /admin/ by admin path change and restrict access to /downloader/. Done. If you have any difficulties with applying the patches please let us know in comments, so we can find the solution together.

Posted in: Magento Maintenance

How to apply SUPEE-3762 without SSH
77 votes, 4.83 avg. rating (96% score)
  • congolo

    I am using magento, there is no folder “lib/Zend/Xml”tion for “Admin routing compatibility mode for extensions”.
    How can I do?