ColdFusion 9.0.1, ColdFusion 9, ColdFusion 8.0.1, and ColdFusion 8 are affected with vulnerabilities mentioned in the security bulletins APSB11-14 and APSB11-15. This TechNote provides fixes for the security issues mentioned in both the bulletins along with the installation instructions.
Note – Updated on Spetember 16 2011
A new issue was found with the security hot fix released with this TechNote. Applying the security hot fix causes ColdFusion to throw session is invalid errors randomly if the J2EE sessions are enabled.
Adobe has updated the hot fix files to include the fixes for the above issue. There are also additional instructions to apply the fix for the above issue only.
- Customers who have already applied the security hot fix, go here to apply the individual fix for this issue. Apply this fix after applying the fix released on July 26.
- Customers, who have not applied the security hot fix, follow the instructions to apply the complete fix.
Note - Updated on July 20 2011
Following bugs were reported against this security bulletin hot fix
1. Verify Data sources functionality broken for all ColdFusion versions.
2. Build number is missing for CF801
3. Thunbs.db file is present in some hot-fix zips.
Adobe has updated the hot fix files to include the fixes for the above issues and have also added additional instructions to apply the fix for the above issues only.
- Customers who have already applied the security hot fix, go here to apply the additional fix.
- Customers who have not applied the security hot fix, follow the instructions below. Hot fix files include the fixes for the above issues.
In the following procedures, {ColdFusion-Home} indicates the following:
- For Server installation: {ColdFusion-Home}
- For Multiserver installation: {JRun-Home}/servers/{YourServer}/cfusion-ear/cfusion-war/
- For J2EE installation: {cfusion-ear-Home}/cfusion-war/
Note: CFIDE.zip and WEB-INF.zip included in the hot fix contains only part of the CFIDE and WEB-INF files. Do not rename present CFIDE or WEB-INF folders to create a backup as per the instructions.
- Download CF901.zip and CFIDE-901.zip. Extract CF901.zip. All the files are extracted to cf901 directory.
- Go to your {ColdFusion-Home}/lib (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib (for Multiserver and J2EE installations) directory. Make a backup of these files if present: commons-fileupload-1.2.jar, ESAPI.properties, esapi-2.0_rc10.jar, log4j.properties, validation.properties, flex-messaging-common.jar, and flex-messaging-core.jar files.
- Download CF9.zip and CFIDE-9.zip. Extract CF9.zip. All the files are extracted to cf9 directory.
- Go to your {ColdFusion-Home}/lib (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib (for Multiserver and J2EE installations) directory. Make a backup of these files if present: commons-fileupload-1.2.jar, ESAPI.properties, esapi-2.0_rc10.jar, log4j.properties, validation.properties, flex-messaging-common.jar, and flex-messaging-core.jar files.
- Download CF801.zip and CFIDE-801.zip. Extract CF801.zip. All the files are extracted to cf801 directory.
- Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory. If hf801-00001.jar, hf801-00002.jar, hf801-1875.jar, hf801-1878.jar, hf801-77218.jar, hf801-73122.jar, or hf801-71471.jar exist, delete them. Otherwise, ignore this step.
- Go to your {ColdFusion-Home}/lib (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib (for Multiserver and J2EE installations) directory. Make a backup of these files if present: commons-fileupload-1.2.jar, ESAPI.properties, ESAPI-1.4.4.jar, log4j.properties, antisamy-1.3-20091014.183120-2.jar, flex-messaging-common.jar, and flex-messaging.jar files.
- Download CF8.zip and CFIDE-8.zip. Extract CF8.zip. All the files are extracted to cf8 directory.
- Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory. If hf800-00001.jar, hf800-00002.jar, hf800-70523.jar, hf800-71471.jar, hf800-73122.jar, hf800-1875.jar, hf800-77218.jar, or hf800-1878.jar exist, delete them. Otherwise, ignore this step.
- Go to your {ColdFusion-Home}/lib (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib (for Multiserver and J2EE installations) directory. Make a backup of these files if present: commons-fileupload-1.2.jar, ESAPI.properties, ESAPI-1.4.4.jar, log4j.properties, antisamy-1.3-20091014.183120-2.jar, flex-messaging-common.jar, and flex-messaging.jar files.
Follow the instructions in the security bulletin APSB11-15 to apply the fix.
ColdFusion 9.0.x
1. For ColdFusion 9.0.1, download cf901-update.zip. For ColdFusion 9.0, download cf9-update.zip.
2. Make backup of index.cfm at {CFIDE-HOME}/administrator/datasources.
3. Extract index.cfm present in the downloaded hot fix to {CFIDE-HOME}/administrator/datasources.
ColdFusion 8.0.1
1. Download cf801-update.zip. Extract the files to a directory.
2. Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory. Delete hf801-00003.jar. If hf801-00003.jar is not present, it's possible that the patch isn't applied yet. Follow the instructions to apply the complete fix.
3. Copy downloaded file lib/updates/hf801-00003.jar to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory
4. Make backup of index.cfm at {CFIDE-HOME}/administrator/datasources.
5. Copy downloaded index.cfm to {CFIDE-HOME}/administrator/datasources.
6. Restart ColdFusion instance. If there are multiple instances, repeat the steps above for each instance.
ColdFusion 8.0
1. Download cf8-update.zip. Extract the files to a directory.
2. Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory. Delete hf800-00003.jar. If hf800-00003.jar is not present, it's possible that the patch isn't applied yet. Follow the instructions to apply the complete fix.
3. Copy downloaded file lib/updates/hf800-00003.jar to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory
4. Make backup of index.cfm at {CFIDE-HOME}/administrator/datasources.
5. Copy downloaded index.cfm to {CFIDE-HOME}/administrator/datasources.
6. Restart ColdFusion instance. If there are multiple instances, repeat the steps above for each instance.
ColdFusion 9.0.1
1. Download cf901-update1.zip. Extract the files to a directory.
2. Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory. Delete hf901-00002.jar. If hf901-00002.jar is not present, it's possible that the patch isn't applied yet. Follow the instructions to apply the complete fix.
3. Copy downloaded file lib/updates/hf901-00002.jar to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory
4. Restart ColdFusion instance. If there are multiple instances, repeat the steps above for each instance.
ColdFusion 9
1. Download cf9-update1.zip. Extract the files to a directory.
2. Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory. Delete hf900-00003.jar. If hf900-00003.jar is not present, it's possible that the patch isn't applied yet. Follow the instructions to apply the complete fix.
3. Copy downloaded file lib/updates/ hf900-00003.jar to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory
4. Restart ColdFusion instance. If there are multiple instances, repeat the steps above for each instance.
ColdFusion 8.0.1
1. Download cf801-update1.zip. Extract the files to a directory.
2. Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory. Delete hf801-00003.jar. If hf801-00003.jar is not present, it's possible that the patch isn't applied yet. Follow the instructions to apply the complete fix.
3. Copy downloaded file lib/updates/hf801-00003.jar to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory
4. Restart ColdFusion instance. If there are multiple instances, repeat the steps above for each instance.
ColdFusion 8
1. Download cf8-update1.zip. Extract the files to a directory.
2. Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory. Delete hf800-00003.jar. If hf800-00003.jar is not present, it's possible that the patch isn't applied yet. Follow the instructions to apply the complete fix.
3. Copy downloaded file lib/updates/hf800-00003.jar to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory
4. Restart ColdFusion instance. If there are multiple instances, repeat the steps above for each instance.
If you installed the hot fix for ColdFusion 9 or ColdFusion 8 and then upgraded (to ColdFusion 9.0.1 or ColdFusion 8.0.1), ensure that you apply the security hot fix for the update.
Note: Previous ColdFusion Security hot fixes - Security bulletins and advisories page
Twitter™ and Facebook posts are not covered under the terms of Creative Commons.