ColdFusion 9.0.1, ColdFusion 9.0, ColdFusion 8.0.1 and ColdFusion 8 are affected with vulnerabilities mentioned in the security bulletin APSB12-06. This TechNote provides fixes for the security issues mentioned in the bulletin along with installation instructions.
This hotfix implements a new setting in ColdFusion, Post Parameter Limit. This limits the number of parameters in a post request. The default value is 100. If a post request contains more parameters as specified, server will not process the request and throws an exception. This is done to protect against DoS attack using Hash Collision. This setting is different from Post Size Limit (ColdFusion Administrator > Settings > Maximum size of post data). We are not exposing this setting in ColdFusion Administrator console, but this limit can be easily changed in neo-runtime.xml file. See point 5 below.
"<var name='postSizeLimit'><number>100.0</number></var>"
"<var name='postParametersLimit'><number>100.0</number></var>"
In the following procedures, {ColdFusion-Home} indicates the following:
- For Server installation: {ColdFusion-Home}
- For Multiserver Installation:{JRun-Home}/servers/{YourServer}/cfusion-ear/cfusion-war/
- For J2EE installation: {cfusion-ear-Home}/cfusion-war/
Note: CFIDE.zip and WEB-INF.zip included in the hotfix contain only part of the CFIDE and WEB-INF files. Do not rename present CFIDE and WEB-INF folders to create as per the instructions.
If you have previously applied Security Hotfix APSB11-29, it's only necessary to apply the jar file.
Download CF801jar.zip and extract hf801-00005.jar
- Go to {ColdFusion-Home}/lib/updates (for Server Installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installation) directory. If hf801-00001.jar, hf801-00002.jar,hf801-00003.jar, hf801-00004.jar, hf801-1875.jar, hf801-1878.jar, hf801-77218.jar, hf801-73122.jar or hf801-71471.jar exist, delete them. Otherwise, ignore this step.
- Download CF8jar.zip and extract hf800-00005.jar.
- Go to {ColdFusion-Home}/lib/updates (for Server Installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installation) directory. If hf800-00001.jar, hf800-00002.jar, hf800-00003.jar, hf800-00004.jar, hf800-70523.jar, hf800-71471.jar, hf800-73122.jar, hf800-1875.jar, hf800-77218.jar or hf800-1878.jar exist, delete them. Otherwise, ignore this step.
Note: If you experience problems in ColdFusion Administrator > Mail > View Undelivered Mail page after applying the previous hotfix, replace undeliveredmail.cfc from {ColdFusion-Home}/wwwroot/CFIDE/administrator/mail from CFIDE backup.
For customers who have not applied Security Hotfix APSB11-29
Download CF801.zip and CFIDE-801.zip. Extract both zip files.
- Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory.If hf801-00001.jar, hf801-00002.jar,hf801-00003.jar, hf801-00004.jar, hf801-1875.jar, hf801-1878.jar, hf801-77218.jar, hf801-73122.jar or hf801-71471.jar exist, delete them. Otherwise, ignore this step.
- Download CF8.zip and CFIDE-8.zip. Extract both zip files.
- Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory. If hf800-00001.jar, hf800-00002.jar, hf800-00003.jar, hf800-00004.jar, hf800-70523.jar, hf800-71471.jar, hf800-73122.jar, hf800-1875.jar, hf800-77218.jar or hf800-1878.jar exist, delete them. Otherwise, ignore this step.
Follow the instructions in the security bulletin APSB11-15 to apply the fix.
If you installed the hotfix for ColdFusion 9 or 8, and then upgraded to ColdFusion 9.0.1 or 8.0.1, respectively, apply the security hotfix for the update.
Note: For previous ColdFusion Security Hotfixes, see the Security bulletins and advisories page.
Note - Updated on March 29, 2012
Following bug is reported for ColdFusion 801 against this security bulletin hotfix.
java.lang.NoSuchMethodError Exception is thrown while using cffile upload.
We have updated the hotfix files of ColdFusion 801 to include the fix for the above issue. Users who have already applied the hotfix for ColdFusion 801 can just update the hotfix jar.
Keywords:
cpsid_93043
Twitter™ and Facebook posts are not covered under the terms of Creative Commons.
