SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Server/CGI)  >   Adobe ColdFusion Vendors:   Macromedia
Macromedia ColdFusion MX Server Discloses Installation Path to Remote Users
SecurityTracker Alert ID:  1006650
SecurityTracker URL:  http://securitytracker.com/id/1006650
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Apr 26 2003
Impact:   Disclosure of system information
Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): MX
Description:   An information disclosure vulnerability was reported in the Macromedia ColdFusion MX Server. A remote user can determine the installation path.

Network Intelligence India Pvt. Ltd. reported that a remote user can query the administrative server on TCP port 8500 with a certain URL to determine the installation path of the software. The query will result in an error message that discloses the installation path.

A demonstration exploit URL is provided:

http://[target]:8500/CFIDE/probe.cfm

[Editor's note: The original advisory from NII cannot be included in this Alert due to copyright restrictions. The original advisory is available at: http://www.nii.co.in/vuln/pdmac.html]

Impact:   A remote user can determine the installation path.
Solution:   The vendor has reportedly indicated that the 'Debugging Settings' page in the Administrator console can be configured to suppress the installation path information that is displayed in the error message. To do so, you can reportedly check 'Enable Robust Exception Information.'
Vendor URL:  www.macromedia.com/software/coldfusion/ (Links to External Site)
Cause:   Access control error
Underlying OS:  Windows (NT), Windows (2000), Windows (XP)
Underlying OS Comments:  Confirmed on Windows 2000

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC