Flaws have been found in multiple versions of Adobe Systems Inc.s Macromedia ColdFusion that could allow remote or local attackers to bypass security restrictions. Malicious local users can also disclose potentially sensitive information, according to a Secunia Inc. advisory.
One of the flaws, which Secunia has dubbed moderately critical, is in the Sandbox Security function. It fails silently without giving an exception when ColdFusion is running on a JRun 4 cluster member with the Java SecurityManager disabled.
According to the alert, this could allow the bypass of some security controls in applications that rely on Sandbox Security.
Another flaw has to do with an input validation error when handling the “Subject” field of the CFMAIL tag. The flaw “can be exploited in an application that uses the tag to attach arbitrary files and send mails with any content,” according to Secunias advisory.
A third vulnerability has been found in the enforcement of the “CFOBJECT/CreateObject(Java)” setting in Sandbox Security. This flaw may be exploited to call restricted methods through an object of a specially crafted class written to the ColdFusion library directory even when the setting has been disabled.
According to Secunia, this flaw may be related to an earlier reported vulnerability, SA12693, which concerned a security bypass for Macromedia ColdFusion MX.
Finally, a flaw has been discovered through which the password hash used to authenticate ColdFusion Administrator can be obtained by developers via an API call.
This can be exploited by malicious developers to obtain the hash and authenticate as Administrator.
All of the reported flaws are to be found in Version 7.0. In addition, ColdFusion MX 6.0, 6.1 and 6.1 with JRun are affected by the first two vulnerabilities.
For ColdFusion MX 7.0, the solution is to update to Version 7.0.1, according to a Macromedia advisory.
For ColdFusion MX 6.0, users are advised by Macromedia to update to Version 6.1 and then apply the hot fix for Version 6.1 (here as a download.)
