CIA RESEARCH

Alerts

[CIA-1074-Alert] Adobe ColdFusion Multiple Vulnerabilities

Summary:

Several vulnerabilities were disclosed in ColdFusion MX 7 that allows an attacker to conduct Cross-Site Scripting (XSS) attacks, as well as discover other information about the ColdFusion server and network configuration.

Technical Details:

Vulnerabilities in ColdFusion MX 7 allow an attacker to bypass input validation filters to conduct Cross-Site Scripting attacks by inserting HTML encoded Null characters within script tags. Additionally, if a global error handler has not been defined for various filetypes it is possible to produce ColdFusion errors that contain the absolute path to web content. This allows the attacker to obtain information about the servers internal configuration. It is also possible to launch certain attacks causing the ColdFusion server to disclose internal IP addresses corresponding to the ColdFusion server.

Solution:

Apply the security fix from Adobe. Check with Adobe support to determine if a security fix has been released for these issues.

CVE Reference:

CVE-2006-6482
CVE-2006-6483

SecurityTracker Number(s):

1017361

Vendor URL:

Adobe

About the Cenzic CIA Team:

Cenzic Intelligent Analysis (CIA) is Cenzic's research arm that focuses on continuous research for application vulnerabilities. Industry Research, Vulnerability assessment, penetration testing, and security testing - that's what Cenzic Intelligent Analysis Research is all about. Cenzic has dedicated experts whose sole job is to perform ongoing research to find not only common vulnerabilities but also vulnerabilities found in customer applications and make them available to our customers and to the community at large.

About Cenzic:

Cenzic provides Hailstorm^® the revolutionary enterprise software suite for automated application security assessment and compliance that allows corporations and government organizations to dramatically improve the security of commercial and custom applications. Hailstorm enables security experts, QA professionals, and developers to work together to assess, analyze, and remediate applications for security vulnerabilities, and verify compliance with security policies. Benefits include reduced security risk and liability, lower development and testing costs, and faster time-to-market. Cenzic's customers are currently in the financial services and e-marketplaces sectors. For more information visit www.cenzic.com or call 1-866-4-CENZIC