Critical Security Fix for OpenEMR setup.php
From OpenEMR Project Wiki
Revision as of 07:06, 30 November 2017 by Bradymiller (talk | contribs)
Overview
- In November of 2017, there were 2 critical security vulnerabilities regarding the setup.php script reported in OpenEMR 5.0.0 .
- Details of the first vulnerability can be found here: Critical Security Fix for CVE-2017-16540
- And details of the second vulnerability can be found on this article (this article also does a nice job covering the first vulnerability): https://www.helpnetsecurity.com/2017/11/29/openemr-flaw-medical-records-exposed/
Secure Your OpenEMR
- In order to protect yourself from this vulnerability:
- If using OpenEMR 5.0.0:
- Update to the most recent patch via following instructions: OpenEMR Patches
- Remove the setup.php file from the openemr web directory (if you need this file in the future, then can download it at setup.php).
- If using OpenEMR 4.2.2 or lower:
- Remove the setup.php file from the openemr web directory.
OpenEMR Community Response
- OpenEMR is an open source project and community that includes many professionals, volunteers, and physicians around the world. Security is taken very seriously and both of the above vulnerabilities were fixed and these patches were announced within several days of initial contact by the security firms. The OpenEMR community is proud of the OpenEMR product and also proud of the very fast turn around time to fix and release/announce the security patches. There have been several negative articles and quotes by security firms in order to market their own security products or firms at the cost of OpenEMR. Rather than focus on the end goal, which is to provide users a clear path to secure their OpenEMR systems, these negative articles have instead focused on marketing blame along with doom and gloom, so their security firms can profit; and in the end they have made it less clear for how OpenEMR users can secure their OpenEMR systems from these vulnerabilities. A fair article that discusses the vulnerabilities and provides a clear route for OpenEMR users to secure their systems can be found here: https://www.helpnetsecurity.com/2017/11/29/openemr-flaw-medical-records-exposed/ .
