Ben Forta's Blog - ColdFusion

ColdFusion Security Hotfix APSB13-13

Thu, 16 May 2013 23:27:00 -0400

The ColdFusion team has released a hotfix for the security alert mentioned last week. This issue affects ColdFusion 10.x and 9.x on all platforms.

ColdFusion Security Advisory

Wed, 08 May 2013 22:22:00 -0400

The Adobe Security team has issued a security advisory for vulnerability (CVE-2013-3336) which could permit an unauthorized user to remotely retrieve files stored on the server. This vulnerability affects ColdFusion 10.x, 9.x, and earlier versions (on Windows, Mac and UNIX), but will not affect you if you have adhered to the recommendations in the Lockdown Guide (or if you've blocked all /cfide access).

ColdFusion Community Portal Launched

Tue, 07 May 2013 11:28:00 -0400

The ColdFusion team has launched the ColdFusion Community Portal (powered, of course, by ColdFusion using Mura CMS).

ColdFusion Security Hotfix Posted

Tue, 09 Apr 2013 15:20:00 -0400

The ColdFusion team today released a hotfix for ColdFusion 9.x and 10.x for Windows, Mac, and UNIX. This hotfix addresses two potential security issues.

ColdFusion 10 Book Is Shipping

Thu, 04 Apr 2013 10:05:00 -0400

Adobe ColdFusion Web Application Construction Kit: ColdFusion 10 Enhancements and Improvements is now shipping. As noted a while back, this book is intended to be used as a 4th volume in the CFWACK series.This new volume contains 19 brand new chapters on HTML5 and web enhancements, new security and administration options, and more. And all this goodness is brought to you by noted ColdFusion experts and team members: Chandan Kumar, Charlie Arehart, Hemant Khandelwal, Ken Fricklas, Raymond Camden, and Rob Brooks-Bilson. More details are on the book page.

More On ColdFusion On AWS

Mon, 25 Mar 2013 10:17:00 -0400

A couple of weeks ago I mentioned the availability of ColdFusion 10 on Amazon Web Services (AWS). To better explain this offering, Adobe engineer Chandan Kumar recorded this video:

Pre-Release For Next ColdFusion

Wed, 20 Mar 2013 11:42:00 -0400

We are working on the next major versions of ColdFusion (code-named "Splendor") and ColdFusion Builder (code-named "Thunder"). If you'd like access to the pre-release (when it's available) then fill in this survey.

ColdFusion Now On AWS

Thu, 14 Mar 2013 08:35:00 -0400

Amazon Web Services (AWS) offers a complete set of infrastructure and application services that enable you to run virtually everything in the cloud: from enterprise applications and big data projects to social games and mobile apps. The benefits include low upfront costs, the ability to scale on demand, and more. And now ColdFusion 10 for AWS is available offering ColdFusion users faster time to market, lower costs, and greater scalability.The ColdFusion AMI (ColdFusion Enterprise Amazon Machine Image) is purchased hourly, $0.15/hour for a large instance and $0.30/hour for an x-large instance. It is available on both Windows 2008 R2 and Ubuntu 12.0.4.

ColdFusion Now Supports Windows 8 And Windows Server 2012

Wed, 06 Mar 2013 03:16:00 -0400

Title says it all, ColdFusion 10 now supports Windows 8 and Windows Server 2012.

Upgrading ColdFusion To Java 7

Sun, 03 Mar 2013 20:42:00 -0400

ColdFusion 10 shipped with Java version 6 (also referred to as JRE 1.6). And until recently, ColdFusion 9 and 10 users had to use Java 6 and could not upgrade to Java 7 (JRE 1.7). But Oracle recently announced that Java 6 is no longer being updated as of the end of February 2013, which is why it was so critical for us to release updates for ColdFusion 9.x and ColdFusion 10 to provide support for JRE 1.7. Now that ColdFusion supports Java 7, you should indeed upgrade, and (as requested by several ColdFusion users) here are some instructions and pointers.ColdFusion ships with a Java runtime, and that's most likely what your ColdFusion server is using. To upgrade the JRE you actually leave the existing one intact (which makes it possible to easily restore to the prior state if something goes wrong). When you upgrade the Java runtime you install a new copy of Java, and then tell ColdFusion to use it instead of the one used previously. Note: If you are running 32bit ColdFusion on Windows you'll need the Java 7 JDK instead of the JRE, on all other platforms the JRE will suffice. (Obviously, make sure you have backups, and you probably don't want to make these changes during peak use time, this is definitely an off-peak type of upgrade). Ok, here's what you need to do ...

ColdFusion stores the path of its Java runtime in /cfusion/bin/jvm.config. Make a backup of this file! That way, if something goes wrong, you can simply stop ColdFusion, restore that file, restart ColdFusion, and you'll be back up and running as if you'd have changed nothing at all.
Download JRE 7 (or JDK 7) on to your ColdFusion server. Make sure you pick the right version for your OS. If you are using 32bit ColdFusion you must install the 32bit JRE, and if you are using 64bit ColdFusion you must install the 64bit JRE. (Pay attention to the 32bit versus 64bit decision, on a 64bit machine the page may default to 32bit if it detects you are using a 32bit web browser).
Once you have downloaded JRE 1.7, install it on your server.
Note the JRE 1.7 installation folder, you'll need the full path to it.
Log in to ColdFusion Administrator.
Go to the Server Settings > Java and JVM page.
Replace the Java Virtual Machine Path with the path to the newly installed JRE 1.7 (you can also click Browse Server to locate the folder), then click Submit Changes.
You will be instructed to restart ColdFusion, so do that.
Once ColdFusion has restarted, log back into the ColdFusion Administrator and go to Server Settings > Settings Summary. In the JVM Details section Java Version should indicate that you are running 1.7.0_15 (or newer).

That's all there is to it! Obviously, you should test that your sites and apps are all working properly. And as noted previously, if something is not working, you can always stop ColdFusion, restore the jvm.config file, and then restart, to return ColdFusion back to its pre-upgraded state.

ColdFusion Update Check URL

Fri, 01 Mar 2013 15:49:00 -0400

Earlier this week I presented a webinar on ColdFusion 10. During that session I noted that, in my own opinion, the single most critical reason to upgrade to CF10 was the simplified and improved update process which dramatically simplifies the process of keeping your server up-to-date with the latest patches or hotfixes. One attendee asked about the server making outbound requests, voicing a concern that firewalls may block this checking, and wanting to know what the server actually needs to talk to. So, here's the answer.On scheduled intervals (and when checked from within ColdFusion Administrator) ColdFusion makes an outbound HTTP request (over port 80) to http://www.adobe.com:80/go/coldfusion-updates, which redirects to http://download.adobe.com/pub/adobe/coldfusion/xml/updates.xml. If there are updates available they are downloaded from the addresses in that XML file, all on host download.adobe.com. So, as long as you server can make outbound HTTP requests (on standard HTTP port 80) to hosts download.adobe.com and www.adobe.com, you should have no problem checking for and applying updates via the new update mechanism. And if you want to limit the hosts that need to be accessed, you can actually go to the Settings page in ColdFusion Administrator > Server Update > Updates, and change the Update Site URL to http://download.adobe.com/pub/adobe/coldfusion/xml/updates.xml (bypassing the extra call and redirect).

ColdFusion 9 And JDK 1.7

Wed, 27 Feb 2013 08:31:00 -0400

We just released an update for ColdFusion 10 to support JDK 1.7. But what if you are still on ColdFusion 9? Well, we have also released hotfixes that add JDK 1.7 support to ColdFusion 9, ColdFusion 9.0.1, and ColdFusion 9.0.2 (yes, three different hotfixes, so check the exact version of your CF9 installation).

ColdFusion 10 Update 8 Released

Wed, 27 Feb 2013 08:27:00 -0400

ColdFusion 10 Update 8 has been released. The most important change is support for JDK 1.7 (ColdFusion 10 is now certified on JDK 1.7 Update 15).

ColdFusion Team Launches YouTube Channel

Thu, 24 Jan 2013 12:28:00 -0400

The ColdFusion team has announced the launch of their ColdFusion YouTube channel.

Critical ColdFusion Hotfix Posted

Tue, 15 Jan 2013 12:51:00 -0400

The ColdFusion team has just released ColdFusion 10 Update 7 (and a fix for ColdFusion 9, too). This is a critical hotfix that addresses the recent security vulnerabilities that were being exploited in the wild. Please install this one quickly!