Issue
ColdFusion 9.0.1, ColdFusion 9.0, ColdFusion 8.0.1 and ColdFusion 8 are affected with vulnerabilities mentioned in the security bulletin APSB12-15. This TechNote provides fixes for the security issues mentioned in the bulletin along with installation instructions.
Solution
Notes
- Hot fix files contain some of the previous security hot fixes.
- Don't remove any jar that start with chf; they are Cumulative Hot Fix Jar.
- CSRF protection requires that SessionManagement is enabled. If Session Variables are disabled from Administration Console, CSRF protection is disabled.
- If ColdFusion throws an exception "java.io.FileNotFoundException.. /logs/esapiconfig.log" after applying hot fix, go to /lib/log4j.properties and update absolute path for esapiconfig.log.
- This hot fix has a new setting in ColdFusion, Post Parameter Limit. This setting limits the number of parameters in a post request. The default value is 100. If a post request contains more parameters as specified, the server doesn't process the request and throws an exception. This process protects against DoS attack using Hash Collision. This setting is different from Post Size Limit (ColdFusion Administrator > Settings > Maximum size of post data). This setting isn't exposed in the ColdFusion Administrator console. But you can easily change this limit in the neo-runtime.xml file. See point 5 below.
- Customers who want to change postParameterLimit, go to {ColdFusion-Home}/lib for Server Installation or {ColdFusion-Home}/WEB-INF/cfusion/lib for Multiserver or J2EE installation. Open file neo-runtime.xml, after line.
"<var name='postSizeLimit'><number>100.0</number></var>"
Add the line below and you can change 100 with the desired number.
"<var name='postParametersLimit'><number>100.0</number></var>"
Definition for ColdFusion-Home:
In the following procedures, {ColdFusion-Home} indicates the following:
- For Server installation: {ColdFusion-Home}
- For Multiserver Installation:{JRun-Home}/servers/{YourServer}/cfusion-ear/cfusion-war/
- For J2EE installation: {cfusion-ear-Home}/cfusion-war/
Note: CFIDE.zip and WEB-INF.zip included in the hot fix contain only part of the CFIDE and WEB-INF files. Do not rename present CFIDE and WEB-INF folders, as per the instructions.
Section 1:
Use these instructions if you have previously applied Security Hotfix APSB12-06.
ColdFusion 9.0.1
- Download CF901jar.zip and extract hf901-00005.jar.
- In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper-right corner.
- In the update file text box, browse and select hf901-00005.jar and click submit.
- Stop the ColdFusion instance.
- Go to {ColdFusion-Home}/lib/updates (for Server Installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installation) directory. If hf901-00001.jar, hf901-00002.jar, hf901-00003.jar, or hf901-00004.jar exist, delete them. Otherwise, ignore this step.
- Start the ColdFusion instance.
- If there are multiple instances, repeat steps 2 through 6 for each instance.
ColdFusion 9.0
- Download CF9jar.zip and extract hf900-00006.jar.
- In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper-right corner.
- In the update file text box, browse and select hf900-00006.jar and click Submit.
- Stop the ColdFusion instance.
- Go to {ColdFusion-Home}/lib/updates (for Server Installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installation) directory. If hf900-00001.jar, hf900-00002.jar, hf900-00003.jar, hf900-00004.jar, or hf900-00005.jar exist, delete them. Otherwise, ignore this step.
- Start the ColdFusion instance.
- If there are multiple instances, repeat steps 2 through 6 for each instance.
ColdFusion 8.0.1
- Download CF801jar.zip and CFIDE-hf801-00006.zip. Extract both zip files.
- In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper-right corner.
- In the update file text box, browse and select hf801-00006.jar and click Submit.
- Stop the ColdFusion instance.
- Go to {ColdFusion-Home}/lib/updates (for Server Installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installation) directory. If hf801-00001.jar, hf801-00002.jar, hf801-00003.jar, hf801-00004.jar, hf801-00005.jar, hf801-1875.jar, hf801-1878.jar, hf801-77218.jar, hf801-73122.jar, or hf801-71471.jar exist, delete them. Otherwise, ignore this step.
- Go to {CFIDE-HOME}/administrator/cftags and take backup of cftags folder.
- Extract all the files in CFIDE-hf801-00006.zip and copy them to {CFIDE-HOME}/administrator/cftags/.
- Start the ColdFusion instance.
- If there are multiple instances, repeat steps 2 through 8 for each instance.
ColdFusion 8.0
- Download CF800jar.zip and CFIDE-hf800-00006.zip. Extract both zip files.
- In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper-right corner.
- In the update file text box, browse and select hf800-00006.jar and click Submit.
- Stop the ColdFusion instance.
- Go to {ColdFusion-Home}/lib/updates (for Server Installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installation) directory. If hf800-00001.jar, hf800-00002.jar, hf800-00003.jar, hf800-00004.jar, hf800-00005.jar, hf800-70523.jar, hf800-71471.jar, hf800-73122.jar, hf800-1875.jar, hf800-77218.jar, or hf800-1878.jar exist, delete them. Otherwise, ignore this step.
- Go to {CFIDE-HOME}/administrator/cftags and take backup of cftags folder.
- Extract all the files in CFIDE-hf800-00006.zip and copy them to {CFIDE-HOME}/administrator/cftags/.
- Start the ColdFusion instance.
- If there are multiple instances, repeat steps 2 through 8 for each instance.
Section 2
Use these instructions if you have not applied Security Hotfix APSB12-06.
ColdFusion 9.0.1
- Download CF901.zip and CFIDE-901.zip. Extract both zip files.
- In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper-right corner.
- In the update file text box, browse and select hf901-00005.jar located under CF901/lib/updates.
- Click Submit changes.
- Stop the ColdFusion instance.
- Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory. If hf901-00001.jar, hf901-00002.jar, hf901-00003.jar, or hf901-00004.jar exist, delete them. Otherwise, ignore this step.
- Go to {CFIDE-HOME} and make a backup of CFIDE folder.
- Extract all the files in CFIDE-901.zip to the web root directory that has {CFIDE-HOME} folder.
- Go to {ColdFusion-Home}/wwwroot/WEB-INF directory and make a backup of WEB-INF folder.
- Go to CF901 directory and extract all the files in WEB-INF.zip to {ColdFusion-Home}/wwwroot (for Server Install) and {ColdFusion-Home} (for MultiServer and J2EE installations) directory.
- Go to your {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install) and take a backup of log4j.properties.
- Go to CF901/lib directory and copy all the files to {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install).
- Start the ColdFusion Instance.
- If there are multiple instances, repeat steps 2 through 13 for each instance.
ColdFusion 9.0
- Download CF9.zip and CFIDE-9.zip. Extract both zip files.
- In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper-right corner.
- In the update file text box, browse and select hf900-00006.jar located under CF9/lib/updates.
- Click Submit changes.
- Stop the ColdFusion instance.
- Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory. If hf900-00001.jar, hf900-00002.jar, hf900-00003.jar, hf900-00004.jar, or hf900-00005.jar exist, delete them. Otherwise, ignore this step.
- Go to {CFIDE-HOME} and make a backup of CFIDE folder.
- Extract all the files in CFIDE-9.zip to the web root directory that has {CFIDE-HOME} folder.
- Go to {ColdFusion-Home}/wwwroot/WEB-INF directory and make a backup of WEB-INF folder.
- Go to CF9 directory and extract all the files in WEB-INF.zip to {ColdFusion-Home}/wwwroot (for Server Install) and {ColdFusion-Home} (for MultiServer and J2EE installations) directory.
- Go to your {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install) and take a backup of log4j.properties.
- Go to CF9/lib directory and copy all the files to {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install).
- Start the ColdFusion Instance.
- If there are multiple instances, repeat steps 2 through 13 for each instance.
ColdFusion 8.0.1
- Download CF801.zip and CFIDE-801.zip. Extract both zip files.
- In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper-right corner.
- In the update file text box, browse and select hf801-00006.jar located under CF801/lib/updates.
- Click Submit changes.
- Stop the ColdFusion instance.
- Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory. If hf801-00001.jar, hf801-00002.jar, hf801-00003.jar, hf801-00004.jar, hf801-00005.jar, hf801-1875.jar, hf801-1878.jar, hf801-77218.jar, hf801-73122.jar, or hf801-71471.jar exist, delete them. Otherwise, ignore this step.
- Go to {CFIDE-HOME} and make a backup of CFIDE folder.
- Extract all the files in CFIDE-801.zip to the web root directory that has {CFIDE-HOME} folder.
- Go to {ColdFusion-Home}/wwwroot/WEB-INF directory and make a backup of WEB-INF folder.
- Go to CF801 directory and extract all the files in WEB-INF.zip to {ColdFusion-Home}/wwwroot (for Server Install) and {ColdFusion-Home} (for MultiServer and J2EE installations) directory.
- Go to your {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install) and take a backup of log4j.properties.
- Go to CF801/lib directory and copy all the files to {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install).
- Start the ColdFusion Instance.
- If there are multiple instances, repeat steps 2 through 13 for each instance.
ColdFusion 8.0
- Download CF8.zip and CFIDE-8.zip. Extract both zip files.
- In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper-right corner.
- In the update file text box, browse and select hf800-00006.jar located under CF8/lib/updates.
- Click Submit changes.
- Stop the ColdFusion instance.
- Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory. If hf800-00001.jar, hf800-00002.jar, hf800-00003.jar, hf800-00004.jar, hf800-00005.jar hf800-70523.jar, hf800-71471.jar, hf800-73122.jar, hf800-1875.jar, hf800-77218.jar, or hf800-1878.jar exist, delete them. Otherwise, ignore this step.
- Go to {CFIDE-HOME} and make a backup of CFIDE folder.
- Extract all the files in CFIDE-8.zip to the web root directory that has {CFIDE-HOME} folder.
- Go to {ColdFusion-Home}/wwwroot/WEB-INF directory and make a backup of WEB-INF folder.
- Go to CF8 directory and extract all the files in WEB-INF.zip to {ColdFusion-Home}/wwwroot (for Server Install) and {ColdFusion-Home} (for MultiServer and J2EE installations) directory.
- Go to your {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install) and take a backup of log4j.properties.
- Go to CF8/lib directory and copy all the files to {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install).
- Start the ColdFusion Instance.
- If there are multiple instances, repeat steps 2 through 13 for each instance.
ColdFusion integrated/installed with LCDS (For Section 2)
Follow the instructions in the security bulletin APSB11-15 to apply the fix.
Upgrading after installing the hot fix
If you installed the hot fix for ColdFusion 9 or 8, and then upgraded to ColdFusion 9.0.1 or 8.0.1, respectively, apply the security hot fix for the update.
Note:
- For previous ColdFusion Security hot fixes, see the Security bulletins and advisories page.
- This Security Fix does not affect ColdFusion 9.0.2 and ColdFusion 10.