ColdFusion 9.0.1, ColdFusion 9.0, ColdFusion 8.0.1, and ColdFusion 8 are affected with vulnerabilities mentioned in the security bulletin APSB11-29. This TechNote provides fixes for the security issues mentioned in the bulletin, along with installation instructions.
Customers who have applied the previous Security Hotfix APSB11-14 (included in ColdFusion 9.0.1 Cumulative Hotfix 2), see Section1. If you have not applied the previous Security Hotfix APSB11-14, see Section 2.
Follow the instructions that apply to your version of ColdFusion. Do not apply these fixes to any beta or prerelease version of ColdFusion.
- Hot fix files contain some of the previous security hot fixes.
- With this hot fix, ColdFusion doesn't autogenerate "action" for CFFORM tag for security considerations. Adobe recommends that developers always specify action for CFFORM. To roll back to previous behavior, you can add "-Dcoldfusion.generateformaction=true" in JVM arguments. Adding this could mean that the server is prone to the security vulnerabilities handled in this hot fix.
- CSRF protection requires that SessionManagement is enabled. If Session Variables are disabled from Administration Console, CSRF protection is disabled.
- If ColdFusion throws an exception "java.io.FileNotFoundException.. /logs/esapiconfig.log" after applying hot fix, go to /lib/log4j.properties and update absolute path for esapiconfig.log.
In the following procedures, {ColdFusion-Home} indicates the following:
- For Server installation: {ColdFusion-Home}
- For Multiserver Installation:{JRun-Home}/servers/{YourServer}/cfusion-ear/cfusion-war/
- For J2EE installation: {cfusion-ear-Home}/cfusion-war/
Note: CFIDE.zip and WEB-INF.zip included in the hot fix contain only part of the CFIDE and WEB-INF files. Do not rename present CFIDE and WEB-INF folders to create as per the instructions.
If you have previously applied Security Hotfix APSB11-14, it's only necessary to apply the jar file.
-
In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper-right corner.
In the update file textbox, browse and select hf901-00003.jar and click Submit.
Stop the ColdFusion instance.
Go to {ColdFusion-Home}/lib/updates (for Server Installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installation) directory. If hf901-00001.jar or hf901-00002.jar exist, delete them. Otherwise, ignore this step.
Start the ColdFusion instance.
If there are multiple instances, repeat steps 2 through 6 for each instance.
-
In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper-right corner.
In the update file textbox, browse and select hf900-00004.jar and click Submit.
Stop the ColdFusion instance.
Go to {ColdFusion-Home}/lib/updates (for Server Installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installation) directory. If hf900-00001.jar, hf900-00002.jar or hf900-00003.jar exist, delete them. Otherwise, ignore this step.
Start the ColdFusion instance.
If there are multiple instances, repeat steps 2 through 6 for each instance.
-
In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper-right corner.
In the update file textbox, browse and select hf801-00004.jar and click submit.
Stop the ColdFusion instance.
Go to {ColdFusion-Home}/lib/updates (for Server Installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installation) directory. If hf801-00001.jar, hf801-00002.jar, hf801-00003.jar, hf801-1875.jar, hf801-1878.jar, hf801-77218.jar, hf801-73122.jar, or hf801-71471.jar exist, delete them. Otherwise, ignore this step.
Start the ColdFusion instance.
If there are multiple instances, repeat steps 2 through 6 for each instance.
-
In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper-right corner.
In the update file text box, browse and select hf800-00004.jar and click submit.
Stop the ColdFusion instance.
Go to {ColdFusion-Home}/lib/updates (for Server Installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installation) directory. If hf800-00001.jar, hf800-00002.jar, hf800-00003.jar, hf800-70523.jar, hf800-71471.jar, hf800-73122.jar, hf800-1875.jar, hf800-77218.jar, or hf800-1878.jar exist, delete them. Otherwise, ignore this step.
Start the ColdFusion instance.
If there are multiple instances, repeat steps 2 through 6 for each instance.
Note: If you experience problems in ColdFusion Administrator > Mail > View Undelivered Mail page after applying the previous hot fix, replace undeliveredmail.cfc from {ColdFusion-Home}/wwwroot/CFIDE/administrator/mail from CFIDE backup.
For customers who have not applied Security Hotfix APSB11-14.
-
In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper-right corner.
In the update file text box, browse and select hf901-00003.jar located under CF901/lib/updates.
-
Stop the ColdFusion instance.
Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory. If hf901-00001.jar or hf901-00002.jar exists, delete them. Otherwise, ignore this step.
Go to {CFIDE-HOME} and make a backup of CFIDE folder.
Extract all the files in CFIDE-901.zip to the web root directory that has {CFIDE-HOME} folder.
Go to {ColdFusion-Home}/wwwroot/WEB-INF directory and make a backup of WEB-INF folder.
Go to CF901 directory and extract all the files in WEB-INF.zip to {ColdFusion-Home}/wwwroot (for Server Install) and {ColdFusion-Home} (for MultiServer and J2EE installations) directory.
Go to your {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install) and take a backup of log4j.properties.
Go to CF901/lib directory and copy all the files to {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install).
Start the ColdFusion Instance.
If there are multiple instances, repeat steps 2 through 13 for each instance.
-
In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper-right corner.
In the update file text box, browse and select hf900-00004.jar located under CF9/lib/updates.
-
Stop the ColdFusion instance.
Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory. If hf900-00001.jar, hf900-00002.jar, or hf900-00003.jar exists, delete them. Otherwise ignore this step.
Go to {CFIDE-HOME} and make a backup of CFIDE folder.
Extract all the files in CFIDE-9.zip to the web root directory that has {CFIDE-HOME} folder.
Go to {ColdFusion-Home}/wwwroot/WEB-INF directory and make a backup of WEB-INF folder.
Go to CF9 directory and extract all the files in WEB-INF.zip to {ColdFusion-Home}/wwwroot (for Server Install) and {ColdFusion-Home} (for MultiServer and J2EE installations) directory.
Go to your {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install) and make a backup of log4j.properties.
Go to CF9/lib directory and copy all the files to {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install).
Start the ColdFusion instance.
If there are multiple instances, repeat steps 2 through 13 for each instance.
-
In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper-right corner.
In the update file text box, browse and select hf801-00004.jar located under CF801/lib/updates.
-
Stop the ColdFusion instance.
Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory. If hf801-00001.jar, hf801-00002.jar, hf801-00003.jar, hf801-1875.jar, hf801-1878.jar, hf801-77218.jar, hf801-73122.jar, or hf801-71471.jar exist, delete them. Otherwise, ignore this step.
Go to {CFIDE-HOME} and make a backup of CFIDE folder.
Extract all the files in CFIDE-801.zip to the web root directory that has {CFIDE-HOME} folder.
Go to {ColdFusion-Home}/wwwroot/WEB-INF directory and make a backup of WEB-INF folder.
Go to CF801 directory and extract all the files in WEB-INF.zip to {ColdFusion-Home}/wwwroot (for Server Install) and {ColdFusion-Home} (for MultiServer and J2EE installations) directory.
Go to your {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install) and make a backup of log4j.properties
Go to CF801/lib directory and copy all the files to {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install).
Start the ColdFusion Instance.
If there are multiple instances, repeat steps 2 through 13 for each instance.
-
In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper-right corner.
In the update file text box, browse and select hf800-00004.jar located under CF8/lib/updates.
-
Stop the ColdFusion instance.
Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory. If hf800-00001.jar, hf800-00002.jar, hf800-00003.jar, hf800-70523.jar, hf800-71471.jar, hf800-73122.jar, hf800-1875.jar, hf800-77218.jar, or hf800-1878.jar exist, delete them. Otherwise, ignore this step.
Go to {CFIDE-HOME} and make a backup of CFIDE folder.
Extract all the files in CFIDE-8.zip to the web root directory that has {CFIDE-HOME} folder.
Go to {ColdFusion-Home}/wwwroot/WEB-INF directory and make a backup of WEB-INF folder.
Go to CF8 directory and extract all the files in WEB-INF.zip to {ColdFusion-Home}/wwwroot (for Server Install) and {ColdFusion-Home} (for MultiServer and J2EE installations) directory.
Go to your {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install) and take a backup of log4j.properties
Go to CF8/lib directory and copy all the files to {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install).
Start the ColdFusion instance.
If there are multiple instances, repeat steps 2 through 13 for each instance.
Follow the instructions in the security bulletin APSB11-15 to apply the fix.
If you installed the hot fix for ColdFusion 9 or 8, and then upgraded to ColdFusion 9.0.1 or 8.0.1, respectively, apply the security hot fix for the update.
Note: For previous ColdFusion Security Hotfixes, see the Security bulletins and advisories page.
April 4, 2013: Added Step #2 in Note section.
Keywords:
ColdFusion security hotfix, 9.0.1,9.0,8.0.1,8.0,APSB11-29; cpsid_92512
Twitter™ and Facebook posts are not covered under the terms of Creative Commons.
