SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Server/CGI)  >   Adobe ColdFusion Vendors:   Macromedia
Macromedia ColdFusion Lets Remote Users Deny Service By Sending Many Form Fields
SecurityTracker Alert ID:  1008878
SecurityTracker URL:  http://securitytracker.com/id/1008878
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Jan 28 2004
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): MX 6.1 (all editions), MX 6.1 J2EE (all editions)
Description:   A vulnerability was reported in Macromedia ColdFusion in the processing of form fields. A remote user can cause denial of service conditions on the target system.

It is reported that a remote user can submit a bogus request containing a large number (e.g., several hundred) of form fields to cause ColdFusion MX 6.1 to take an excessive amount of time to process the request.

Macromedia has assigned an "Important" severity rating to this flaw.

Macromedia credits Michael Leahy of Grand Valley State University with reporting this vulnerability.

Impact:   A remote user can cause the target ColdFusion service to consume an excessive amount of time processing a malicious request.
Solution:   The vendor has released a Form fields DoS patch (19 KB ZIP), available at:

http://download.macromedia.com/pub/security/mpsb04-02.zip

See the vendor's advisory for installation instructions, available at:

http://www.macromedia.com/devnet/security/security_zone/mpsb04-02.html

Vendor URL:  www.macromedia.com/devnet/security/security_zone/mpsb04-02.html (Links to External Site)
Cause:   Exception handling error, Resource error
Underlying OS:  Linux (Any), UNIX (HP/UX), UNIX (Solaris - SunOS), Windows (NT), Windows (2000), Windows (XP)

Message History:   None.


 Source Message Contents

Subject:  http://www.macromedia.com/devnet/security/security_zone/mpsb04-02.html


http://www.macromedia.com/devnet/security/security_zone/mpsb04-02.html

 > MPSB04-02 Security Patch available for ColdFusion MX 6.1 form fields Denial of service

Macromedia reported that a remote user can submit a bogus request containing a large 
number (e.g., several hundred) of form fields to cause ColdFusion MX 6.1 to take an 
excessive amount of time to process the request.

A Form fields DoS patch (19 KB ZIP) is available:

http://download.macromedia.com/pub/security/mpsb04-02.zip

See the vendor's advisory for installation instructions.

Macromedia credits Michael Leahy of Grand Valley State University with reporting this 
vulnerability.

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC