ColdFusion security update for version 9 and above
Security | Adobe ColdFusion | Adobe ColdFusion 10 | web application | web application security
A security update for ColdFusion is now available for versions 10, 9, 9.0.1 and 9.0.2.
If you are on ColdFusion 10, you will see a new update 7 within the ColdFusion administrator for you to download and install.
Adobe recommends users update their product installation with this update. Here's a link to the related security bulletin.
36 comments so far ↓
Adobe has been informed through other channels. In the meantime, it's not clear what would happen if you applied only the jar and CFIDE portions of the hotfix, without the WEB-INF portion, so it seems best to wait for an official reply here.
To be clear, this problem with the hotfix files ONLY AFFECTS THOSE ON 9.0.2.
Those on 10, 9.0.1, and 9.0 should absolutely proceed with the instructions here, for this vital security hotfix.
I just don't want anyone to read your comment as being related to mine above about the problem with this one hotfix (because there is only need for a "new hotfix file" for 9.0.2, not for 9.0 or 9.0.1.)
But assuming you do mean what I refer to in the previous paragraph, I would note that Adobe did come out with "9.0.2" in May, which was in fact essentially a "new update for 9" (though it was a full installer, not an updater). It included all the hotfixes and security hotfixes for 9.0 and 9.0.1 as of then, though it also removed Verity (the main reason it came out).
But to be clear for the benefit of some readers, discussion of a new installer for 9 is separate from the discussion of the hotfix above.
As for new updaters, there's been a tendency for them to come out only very occasionally because they do require Adobe rebuilding and retesting such an updater for all the OS's and DB's they support, and in all their variations with different releases within each. Lots of permutations, so lots of work.
Really, this page http://www.adobe.com/support/coldfusion/downloads_updates.html , is entirely insufficient for me to determine the state of CF updates and for me to figure out what I need to apply vs. what I have already applied.
https://github.com/dcepler/unofficial-updater2/blob/master/cf901-hotfix-matrix.pdf?raw=true
It isn't updated yet to include APSB13-03. But to fully patch CF 9.0.1 you need to apply CHF2 first and then APSB13-03.
As for the page you point to, I would agree that it's not got any info on individual hotfixes, nor can it help you assess where you stand on them. It only lists installers and cumulative hotfixes (CHFs): it does not list individual hotfixes (those that come out between cumulatives) nor does it list security hotfixes.
I would agree that a strong argument could be made that the page ought to at least more clearly link to pages that DO have that other info. Definitely room for improvement.
For those who might say, "just give me the URL for the hotfixes. I don't want to read the blog entry", it's http://download.adobe.com/pub/adobe/coldfusion/xml/updates.xml.
Finally, as for the "sep 27" update you refer to on the downloads_updates page, that is ONLY the "mandatory update", which itself needs/needed to be applied by all CF10 users before they could have used the CF10 update mechanism (even within the CF Admin) due to an issue with the Adobe certificate (for all adobe software) that happened just after CF10 came out.
As always, just trying to help.
Please don't misunderstand me: I appreciate that for whatever reason you couldn't see the update and needed a solution. That blog entry is that solution, and for FAR MORE than just providing a link to download the updates manually. As I noted (and I'm repeating this for others in your boat), it offers a LOT MORE information that you will reasonably ask/need if you are going to have to download and/or apply the update manually. Really was trying to help.
There is a mistake in instructions for ColdFusion 9.0.2. The correct set of instructions are as follows -
ColdFusion 9.0.2
1. Download CF902.zip and CFIDE-902.zip. Extract both zip files.
2.In ColdFusion Administrator, select System Information page by clicking the icon "i" in the upper-right corner.
3. In the "Update File" text box, browse and select hf902-00003.jar located under CF902/lib/updates.
4. Click Submit Changes.
5. Stop the ColdFusion instance.
6. Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory. If hf902-00001.jar, hf902-00002.jar exist, delete it. Otherwise, ignore this step.
7. Go to {CFIDE-HOME} and take a backup of CFIDE folder.
8. Extract all the files in CFIDE-902.zip to merge in the web root directory that has {CFIDE-HOME} folder.
9. Start the ColdFusion Instance.
10. If there are multiple instances, repeat steps 2 through 9 for each instance.
These instructions are also updated on technote.
Thanks & Regards,
Adobe ColdFusion Team
In case it may help anyone, I'll note that I have a new "part 3" to the series of blog entries I'd been doing on this recent threat. In it, I share some more info on questions some may have (and have had) on the new hotfix:
http://www.carehart.org/blog/client/index.cfm/2013/1/15/Part3_serious_security_threat
I do not see this option. Is this option only available when you installed RDS when installing CF? Or must this option be available nonetheless
I can propose a couple of reasonable explanations that you are not seeing it (which I grant, neither may be your issue). The challenges have to do with the process of applying the update, which involved extracting files for the CFIDE folder.
It could either be that you extracted it into a location that is NOT where your CF Admin is looking (for its use of the CFIDE folder). Or it could be that you have only one location, and put it in the right place, but when you extracted it, the unzip tool inadvertently placed a new CFIDE folder WITHIN the one you told it to update. I see both problems all the time in my CF server troubleshooting consulting.
Rather than elaborate the details, if those cues don't suffice, I would point you (and interested readers) to a blog entry I did on this: http://www.carehart.org/blog/client/index.cfm/2011/10/21/why_chfs_may_break
Let us know if that or the above help, or not.
It also points out the fix-specific logs available which you could check, which may give additional diagnostic information.
Let us know if that helps.
Can i just get a confirmation on that? I thought in the past we had to do one update after another on CF 9.
The patches are cumalative. Install this current patch and it includes all fixes previously released.
Are you sure everybody, always, should have this option? Or does it depend on the options you choose while installing?
the mentioned options are available for Root admin user only. Are you logging in from root user or another user?
Shilpi
Sorry for the inconvenience!
ColdFusion 10 Update 7 - Continue installation
ColdFusion 10 Update 6 - Continue installation
Progress Information
Progress Information
Error
Confirm overwrite
Uninstall Confirmation
Download does nothing.
when I opened up the console log I'm getting:
ReferenceError: ColdFusion is not defined
ReferenceError: downloadService is not defined
Any ideas? Everything else in Administrator seems to be working fine. It was installed using the CF 10 lockdown guide if that's any help.
There was a change made in APSB12-06 that put a limit on the number of form post fields that ColdFusion could process. And since the security hotfixes are cumulative it is included in APSB13-03. You can either see the note in:
http://helpx.adobe.com/coldfusion/kb/coldfusion-security-hotfix.html
Or a better writeup is here:
http://www.cutterscrossing.com/index.cfm/2012/3/27/ColdFusion-Security-Hotfix-and-Big-Forms
@Adobe, APSB13-03 really should include all the other notes that are on previous security hotfixes otherwise others that have not stayed up to date with them will miss the information.
The first instance worked just fine and I can log back into CFAdmin. However, if I attempt to log in to CFAdmin on the other instance, I receive ColdFusion errors. One of them is 'Variable GETCSRFTOKEN is undefined'.
Is there anything we need to take into account for multiple instances? Has anybody else applied a hotfix to a multi-instance ColdFusion server?
Leave a Comment