ColdFusion Holes Allow Security Bypass, Info Exposure

By Lisa Vaas  |  Posted 2005-12-16 Print this article Print

Flaws in multiple versions of Macromedia ColdFusion could allow remote or local attackers to bypass security restrictions, according to a Secunia advisory.

Flaws have been found in multiple versions of Adobe Systems Inc.s Macromedia ColdFusion that could allow remote or local attackers to bypass security restrictions. Malicious local users can also disclose potentially sensitive information, according to a Secunia Inc. advisory. One of the flaws, which Secunia has dubbed moderately critical, is in the Sandbox Security function. It fails silently without giving an exception when ColdFusion is running on a JRun 4 cluster member with the Java SecurityManager disabled. According to the alert, this could allow the bypass of some security controls in applications that rely on Sandbox Security.
Another flaw has to do with an input validation error when handling the "Subject" field of the CFMAIL tag. The flaw "can be exploited in an application that uses the tag to attach arbitrary files and send mails with any content," according to Secunias advisory.
Click here to read about a trio of security patches from Macromedia. A third vulnerability has been found in the enforcement of the "CFOBJECT/CreateObject(Java)" setting in Sandbox Security. This flaw may be exploited to call restricted methods through an object of a specially crafted class written to the ColdFusion library directory even when the setting has been disabled. According to Secunia, this flaw may be related to an earlier reported vulnerability, SA12693, which concerned a security bypass for Macromedia ColdFusion MX. For advice on how to secure your network and applications, as well as the latest security news, visit Ziff Davis Internets Security IT Hub. Finally, a flaw has been discovered through which the password hash used to authenticate ColdFusion Administrator can be obtained by developers via an API call. This can be exploited by malicious developers to obtain the hash and authenticate as Administrator. All of the reported flaws are to be found in Version 7.0. In addition, ColdFusion MX 6.0, 6.1 and 6.1 with JRun are affected by the first two vulnerabilities. For ColdFusion MX 7.0, the solution is to update to Version 7.0.1, according to a Macromedia advisory. For ColdFusion MX 6.0, users are advised by Macromedia to update to Version 6.1 and then apply the hot fix for Version 6.1 (here as a download.) Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at Security Center Editor Larry Seltzers Weblog.
Lisa Vaas is News Editor/Operations for and also serves as editor of the Database topic center. Since 1995, she has also been a Webcast news show anchorperson and a reporter covering the IT industry. She has focused on customer relationship management technology, IT salaries and careers, effects of the H1-B visa on the technology workforce, wireless technology, security, and, most recently, databases and the technologies that touch upon them. Her articles have appeared in eWEEK's print edition, on, and in the startup IT magazine PC Connection. Prior to becoming a journalist, Vaas experienced an array of eye-opening careers, including driving a cab in Boston, photographing cranky babies in shopping malls, selling cameras, typography and computer training. She stopped a hair short of finishing an M.A. in English at the University of Massachusetts in Boston. She earned a B.S. in Communications from Emerson College. She runs two open-mic reading series in Boston and currently keeps bees in her home in Mashpee, Mass.

Submit a Comment

Loading Comments...
Manage your Newsletters: Login   Register My Newsletters

Rocket Fuel