Critical Security Fix for OpenEMR setup.php

Overview

In November of 2017, there were 2 critical security vulnerabilities regarding the setup.php script reported in OpenEMR 5.0.0 .

• Details of the first vulnerability can be found here: Critical_Security_Fix_for_CVE-2017-16540
• And details of the second vulnerability (it also does a nice job covering the first vulnerability): https://www.helpnetsecurity.com/2017/11/29/openemr-flaw-medical-records-exposed/

Secure Your OpenEMR

In order to protect yourself from this vulnerability:

• If using OpenEMR 5.0.0:

1. Update to the most recent patch via following instructions: OpenEMR Patches
2. Remove the setup.php file from the openemr web directory (if you need this file in the future, then can download it at setup.php).

• If using OpenEMR 4.2.2 or lower:

1. Remove the setup.php file from the openemr web directory.

OpenEMR Community Response

OpenEMR is an open source project and community that includes many professionals, volunteers, and physicians around the world. Security is taken very seriously and both of the above vulnerabilities were fixed and these patches were announced within several days of initial contact by the security firms. The OpenEMR community is proud of the OpenEMR product and also proud of the very fast turn around time to fix and release/announce the security patches. There have been several negative articles and quotes by security firms in order to market their own security products or firms at the cost of OpenEMR. Rather than focus on the end goal, which is to provide users a clear path to secure their OpenEMR systems, these negative articles have instead focused on marketing blame along with doom and gloom, so their security firms can profit; and in the end they have made it less clear for how OpenEMR users can secure their OpenEMR systems from these vulnerabilities. A fair article that discusses the vulnerabilities and provides a clear route for OpenEMR users to secure their systems can be found here: https://www.helpnetsecurity.com/2017/11/29/openemr-flaw-medical-records-exposed/ .