Thoughts, ideas, tips, musings, and pontifications (not necessarily in that order) by Ben Forta ...
NOTE: This is my personal blog, and the opinions and statements voiced here are my own.
Posted At : 4:43 PM
Related Categories:
ColdFusion :
An important ColdFusion security hotfix has been released for ColdFusion 8.x and 9.x. This hotfix addresses a potential vulnerability in ColdFusion Administrator.
(Sorry, I realized none of the Adobe content mentions the vulnerability specifically, so the question re: locking down the administrative access might not make sense.
See http://secunia.com/advisories/40909 where it states "Certain unspecified input passed to the ColdFusion Administrator page is not properly sanitised before being used. This can be exploited to disclose certain data via directory traversal attacks.")
In the CF8 installed at my company, there are l10n files in several folders with different file-dates. Why are they not the same? Should all of them be replaced with this HOTFIX?
Since CF7 is no longer covered under core support, any idea on whether 7.x is impacted by this?
If the CF administrator is locked down via Windows Authenication, any idea on whether that is effective?
Thanks!
See http://secunia.com/advisories/40909 where it states "Certain unspecified input passed to the ColdFusion Administrator page is not properly sanitised before being used. This can be exploited to disclose certain data via directory traversal attacks.")