Pete Freitag Pete Freitag

Path Traversal Vulnerability Security Hotfix for ColdFusion Released

Published on August 12, 2010
By Pete Freitag
coldfusion

Adobe released a security hotfix for a path traversal vulnerability in ColdFusion administrator (CVE-2010-2861, APSB10-18). On the Adobe security bulletin page it lists affected software versions: ColdFusion 8.0, 8.0.1, 9.0, 9.0.1 and earlier versions for Windows, Macintosh and UNIX. Take special notice of the and earlier versions, so if you are running CF7 you will quite possibly still be vulnerable to this.

This vulnerability allows an attacker to ready any file that ColdFusion has permission to read (on windows this should be limited to the same drive that contains the ColdFusion administrator).

Applying the hotfix is quite simple, just replace a couple files in your ColdFusion administrator directory. So go ahead and take care of this now, it should take less than 5 minutes of your time. Also while your at it, make sure you ColdFusion administrator is not publicly accessible. Add IP restrictions, or a web server password.

HackMyCF Updated

My ColdFusion Security Scanner, HackMyCF has been updated to detect this vulnerability. There are a few conditions however in which it can't detect it, so I encourage you to apply the hotfix regardless of what it says.



coldfusion security vulnerabilities hotfix adobe

Path Traversal Vulnerability Security Hotfix for ColdFusion Released was first published on August 12, 2010.

If you like reading about coldfusion, security, vulnerabilities, hotfix, or adobe then you might also like:

Fixinator

The Fixinator Code Security Scanner for ColdFusion & CFML is an easy to use security tool that every CF developer can use. It can also easily integrate into CI for automatic scanning on every commit.


Try Fixinator

CFBreak
The weekly newsletter for the CFML Community


Comments

Hey Pete,
The Adobe instructions seem to indicate that a restart of the CF instances are required after copying the files, which for some would make this a bigger deal. Is that true or should I change that step to "Wipe hands on pants"? Thanks!
by Dave on 08/12/2010 at 2:31:38 PM UTC
@Dave If you have trusted cache enabled, then you need to either restart or flush the cache. To the best of my knowledge restarting should not be required if trusted cache is not on.
by Pete Freitag on 08/12/2010 at 2:36:47 PM UTC
I get bogged down in these updates and fixes on the best of days. I'm a marketing guy, not a server admin... I have MX 7.0.2 and there's no patch available. Any suggestions? I don't keep the CFIDE stuff in the default directory, but is that enough?
by non-tech on 08/17/2010 at 6:44:40 PM UTC
@non-tech That's correct there was no patch issued for CF 7. If you have blocked /CFIDE then you should be protected here.
by Pete Freitag on 08/17/2010 at 8:58:16 PM UTC