Important Java Security Patch Released
By Pete Freitag
Oracle has just released a patch for a critical denial of service vulnerability (CVE-2010-4476) in the Java Runtime.
I have confirmed that this is easily exploited on a ColdFusion server running an unpatched JVM. It's very very probable that you have code that could be exploited.
Any code that run's Java's floating point number parser is vulnerable, so ColdFusion code such as:
<cfparam name="url.x" type="numeric">
When given a malicious input it will cause the processing thread to go into an infinite loop.
Oracle released a new JVM on Feb 15th which will include this patch among others. Java 1.6.0_24 has been certified by Adobe for use on ColdFusion 8.0-9.0.1
I'd like to add a scanner for this on HackMyCF but doing so would crash your server, so I won't be doing that :)
Update We have added a probe feature available to paid subscribers of HackMyCF which will alert you when you need to update your JVM.
Important Java Security Patch Released was first published on February 09, 2011.
If you like reading about java, or security then you might also like:
- Spring4Shell and ColdFusion
- Log4j 1.x Vulnerability Mitigation Guide
- Log4Shell Vulnerability Timeline
- How to get Log4j Version at Runtime in Java
The Fixinator Code Security Scanner for ColdFusion & CFML is an easy to use security tool that every CF developer can use. It can also easily integrate into CI for automatic scanning on every commit.