SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Adobe ColdFusion Vendors:   Macromedia
Macromedia ColdFusion Provides Default Access to CFOBJECT Tag and CreateObject Function
SecurityTracker Alert ID:  1011615
SecurityTracker URL:  http://securitytracker.com/id/1011615
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Oct 11 2004
Impact:   Disclosure of system information, Disclosure of user information, Modification of system information, Modification of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 6.0, 6.1; MX
Description:   A vulnerability was reported in the default configuration of Macromedia ColdFusion. Developers can access objects and tags to gain elevated privileges.

The vendor reported that the CFOBJECT tag and the CreateObject function are accessible to all ColdFusion developers by default, but should be secured in a shared or untrusted developer environment.

A user can invoke standard ColdFusion Markup Language (CFML) code to access Java objects that are used to perform administrative tasks and to extend Java objects to perform other functions.

Impact:   A developer can access objects and functions that they may not be authorized to access.
Solution:   The vendor recommends using the ColdFusion Sandbox Security functionality to disable the CFML CreateObject function and CFOBJECT tag. More information is available at:

http://livedocs.macromedia.com/coldfusion/6.1/htmldocs/appsecur.htm

The vendor's advisory is available at:

http://www.macromedia.com/devnet/security/security_zone/mpsb04-10.html

Vendor URL:  www.macromedia.com/devnet/security/security_zone/mpsb04-10.html (Links to External Site)
Cause:   Access control error, Configuration error
Underlying OS:  Linux (Any), UNIX (HP/UX), UNIX (Solaris - SunOS), Windows (NT), Windows (2000), Windows (XP)

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC