Update your Website Optimizer scripts to secure your site

Tuesday, December 07, 2010 12/07/2010 10:14:00 AM

Earlier this week we notified affected Website Optimizer users of a potential security issue with the Website Optimizer Control Script. If a website or browser has already been compromised by a separate attack, a hacker might also be able to execute malicious code by exploiting a bug in the Website Optimizer Control Script.

We have not seen any evidence indicating that sites using Website Optimizer have been targeted through this bug, but wanted to proactively reach out to site owners. While the probability of this attack is very low, we are urging Website Optimizer users to take action by updating their Control Scripts. We have taken action, so all new experiments created after December 3 are not susceptible.

Any experiments you are currently running need to be updated to fix the issue on your site. Additionally, if you have any Website Optimizer scripts from paused or stopped experiments created before December 3, you should remove or update that code as well.

There are two ways to update your code:

1. Stop current experiments, remove the old scripts, and create a new experiment.
2. Update the code on your site directly. We strongly recommend creating a new experiment as it is the simpler method.

Instructions for both methods are available here at the Website Optimizer Help Center.

We’re committed to keeping Website Optimizer secure, and we will proactively work to prevent any future vulnerabilities.

Posted by Trevor Claiborne, Website Optimizer team