Accessibility

Security Bulletin

MPSB04-01 Security Patch available for ColdFusion MX sandbox security

Originally posted: January 28, 2004
Last updated: January 28, 2004

Summary

ColdFusion MX 6.1 sandbox security can be compromised by creating Java objects without using CreateObject() or <cfobject> even if these features are disabled. The sandbox cannot be compromised externally, but programmers operating in a shared, hosted environment could be vulnerable.

NOTE: ColdFusion MX (aka version 6.0) and ColdFusion MX 6.1 Standard edition are not vulnerable. Earlier versions of ColdFusion are also not vulnerable.

Solution

Macromedia has released a patch that corrects this issue. The Sandbox Security patch (7 KB ZIP) should be downloaded and applied to affected versions of ColdFusion MX 6.1.

Affected Software Versions

  • ColdFusion MX 6.1 Enterprise
  • ColdFusion MX 6.1 J2EE (all editions)

Severity Rating

Macromedia categorizes this issue as a critical update and recommends users immediately patch their ColdFusion MX installation.

Details

Users have the the ability to instantiate classes without using CreateObject() or <cfobject> tags and the security sandbox does not prevent this. This can compromise security in a shared, hosted environment.

The new behavior is:
When sandbox security is in use, users with both the CreateObject function disabled and the <cfobject> tag disabled will not be able to create or instantiate Java objects from ColdFusion Variables using the Java reflection methods.  If a user has access to an existing Java object, for example — when trusted Java objects are created in a shared scope for use by sandbox applications which do not have CreateObject permission — the methods and properties on these objects can still be used without CreateObject permission.

The <cfdump> tag cannot be used to examine Java objects without the CreateObject permission.  This remains true.

The error users will get is:

A security exception occurred while invoking java method on a "java.lang.Class" object.

Making the Changes

NOTE: Back up your existing files before making changes. As always, test the changes in a non-production environment before applying the changes to production servers.

ColdFusion MX 6.1 Enterprise

  1. Download the patch above and expand it
  2. Stop ColdFusion MX
  3. Place the hf53419_61.jar in the {cf_root}/runtime/servers/lib directory.
    (Create the {cf_root}/runtime/servers/lib directory if it does not exist.)

    4. On Unix systems only:

    • Edit the file {cf_root}/runtime/bin/jvm.config

    • Find the JVM classpath section

    • Add {application.home}/runtime/servers/lib as the first entry in the java.class.path list

      Example: #JVM classpath 

      java.class.path={application.home}/runtime/servers/lib,{application.home}/runtime/../../src,{application.home}/lib/cfusion.jar,{application.home}/runtime/lib/webservices.jar
  4. Start ColdFusion MX

ColdFusion MX 6.1 J2EE on Other J2EE Servers

  1. Stop ColdFusion MX

  2. Place the hf53419_61.jar in the directory according to the J2EE server:

    ColdFusion MX for J2EE (WebLogic 7 shown)
    /Bea/WebLogic700/server/bin/applications/cfusion.ear/cfusion.war/WEB-INF/lib

    ColdFusion MX for J2EE (Websphere)
    /WebSphere/AppServer/installedApps/cfusion.ear/cfusion.war/WEB-INF/lib

    ColdFusion MX for J2EE (SunOne)
    /iPlanet/Servers/docs/CFusionMX/WEB-INF/lib directory

    ColdFusion MX for J2EE (JRun) - WAR or EAR deployment
    /jrun4/servers/lib directory

  3. Start ColdFusion MX

NOTE: Back up your existing files before making changes. As always, test the changes in a non-production environment before applying the changes to production servers.

Revisions

February 6, 2004—Incorrect patch path in "making the changes" section ColdFusion MX for J2EE (JRun)
January 28, 2004—Bulletin first created.

Reporting Security Issues

Macromedia is committed to addressing security issues and providing customers with the information on how they can protect themselves. If you identify what you believe may be a security issue with a Macromedia product, please send an email to secure@macromedia.com. We will work to appropriately address and communicate the issue.

Receiving Security Bulletins

When Macromedia becomes aware of a security issue that we believe significantly affects our products or customers, we will notify customers when appropriate. Typically this notification will be in the form of a security bulletin explaining the issue and the response. Macromedia customers who would like to receive notification of new security bulletins when they are released can sign up for our security notification service.

For additional information on security issues at Macromedia, please visit: http://www.macromedia.com/security.

ANY INFORMATION, PATCHES, DOWNLOADS, WORKAROUNDS OR FIXES PROVIDED BY MACROMEDIA IN THIS BULLETIN ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MACROMEDIA AND ITS SUPPLIERS DISCLAIM ALL WARRANTIES, WHETHER EXPRESS OR IMPLIED OR OTHERWISE, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. ALSO, THERE IS NO WARRANTY OF NON-INFRINGEMENT, TITLE OR QUIET ENJOYMENT. (USA ONLY) SOME STATES DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES, SO THE ABOVE EXCLUSION MAY NOT APPLY TO YOU.

IN NO EVENT SHALL MACROMEDIA, INC. OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING, WITHOUT LIMITATION, DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, PUNITIVE, COVER, LOSS OF PROFITS, BUSINESS INTERRUPTION OR THE LIKE, OR LOSS OF BUSINESS DAMAGES, BASED ON ANY THEORY OF LIABILITY INCLUDING BREACH OF CONTRACT, BREACH OF WARRANTY, TORT(INCLUDING NEGLIGENCE), PRODUCT LIABILITY OR OTHERWISE, EVEN IF MACROMEDIA, INC. OR ITS SUPPLIERS OR THEIR REPRESENTATIVES HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. (USA ONLY) SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES, SO THE ABOVE EXCLUSION OR LIMITATION MAY NOT APPLY TO YOU AND YOU MAY ALSO HAVE OTHER LEGAL RIGHTS THAT VARY FROM STATE TO STATE.

Macromedia reserves the right, from time to time, to update the information in this document with current information.