Accessibility

Security Bulletin

MPSB04-02 Security Patch available for ColdFusion MX 6.1 form fields Denial of service

Originally posted: January 28, 2004
Last updated: January 28, 2004

Summary

ColdFusion MX 6.1 is vulnerable to a denial of service attack if a malicious user creates a ficticious request containing a large number of form fields.

Solution

Macromedia has released a Form fields DoS patch (19 KB ZIP) that can be downloaded and applied to ColdFusion MX 6.1 which solves this issue.

Affected Software Versions

  • ColdFusion MX 6.1 (all editions)
  • ColdFusion MX 6.1 J2EE (all editions)

Severity Rating

Macromedia categorizes this issue as a important update and recommends users immediately patch their ColdFusion MX installation.

Details

Submitting a form with several hundred inputs that use range or type validation causes ColdFusion MX to take a very long time to process the request. With the patch applied, performance has been improved to the point where this is no longer an issue.

Making the Changes

Note: Back up your existing files before making changes. As always, test the changes in a non-production environment before applying the changes to production servers.

ColdFusion MX 6.1 Enterprise or Standard Edition

  1. Download the patch above and expand it
  2. Stop ColdFusion MX

  3. Place the hf53685_61.jar in the {cf_root}/runtime/servers/lib directory.

    (Create the {cf_root}/runtime/servers/lib directory if it does not exist.)

    On Unix systems only:

    • Edit the file {cf_root}/runtime/bin/jvm.config

    • Find the JVM classpath section

    • Add {application.home}/runtime/servers/lib as the first entry in the java.class.path list

      Example: #JVM classpath 

      java.class.path={application.home}/runtime/servers/lib,{application.home}/runtime/../../src,{application.home}/lib/cfusion.jar,{application.home}/runtime/lib/webservices.jar
  4. Start ColdFusion MX

ColdFusion MX 6.1 J2EE on Other J2EE Servers

  1. Stop ColdFusion MX

  2. Place the hf53685_61.jar in the directory according to the J2EE server:

    ColdFusion MX for J2EE (WebLogic 7 shown)
    /Bea/WebLogic700/server/bin/applications/cfusion.ear/cfusion.war/WEB-INF/lib

    ColdFusion MX for J2EE (Websphere)
    /WebSphere/AppServer/installedApps/cfusion.ear/cfusion.war/WEB-INF/lib

    ColdFusion MX for J2EE (SunOne)
    /iPlanet/Servers/docs/CFusionMX/WEB-INF/lib directory

    ColdFusion MX for J2EE (JRun)
    /jrun4/servers/lib

  3. Start ColdFusion MX

NOTE: Back up your existing files before making changes. As always, test the changes in a non-production environment before applying the changes to production servers.

Acknowledgements

Macromedia would like to thank Michael Leahy (leahym@gvsu.edu) of Grand Valley State University  for reporting this vulnerability and for working with us to help protect our customers from security attacks.

Revisions

February 6, 2004—Incorrect patch path in "making the changes" section ColdFusion MX for J2EE (JRun)
January 28, 2004—Bulletin first created.

Reporting Security Issues

Macromedia is committed to addressing security issues and providing customers with the information on how they can protect themselves. If you identify what you believe may be a security issue with a Macromedia product, please send an email to secure@macromedia.com. We will work to appropriately address and communicate the issue.

Receiving Security Bulletins

When Macromedia becomes aware of a security issue that we believe significantly affects our products or customers, we will notify customers when appropriate. Typically this notification will be in the form of a security bulletin explaining the issue and the response. Macromedia customers who would like to receive notification of new security bulletins when they are released can sign up for our security notification service.

For additional information on security issues at Macromedia, please visit: http://www.macromedia.com/security.

ANY INFORMATION, PATCHES, DOWNLOADS, WORKAROUNDS OR FIXES PROVIDED BY MACROMEDIA IN THIS BULLETIN ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MACROMEDIA AND ITS SUPPLIERS DISCLAIM ALL WARRANTIES, WHETHER EXPRESS OR IMPLIED OR OTHERWISE, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. ALSO, THERE IS NO WARRANTY OF NON-INFRINGEMENT, TITLE OR QUIET ENJOYMENT. (USA ONLY) SOME STATES DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES, SO THE ABOVE EXCLUSION MAY NOT APPLY TO YOU.

IN NO EVENT SHALL MACROMEDIA, INC. OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING, WITHOUT LIMITATION, DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, PUNITIVE, COVER, LOSS OF PROFITS, BUSINESS INTERRUPTION OR THE LIKE, OR LOSS OF BUSINESS DAMAGES, BASED ON ANY THEORY OF LIABILITY INCLUDING BREACH OF CONTRACT, BREACH OF WARRANTY, TORT(INCLUDING NEGLIGENCE), PRODUCT LIABILITY OR OTHERWISE, EVEN IF MACROMEDIA, INC. OR ITS SUPPLIERS OR THEIR REPRESENTATIVES HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. (USA ONLY) SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES, SO THE ABOVE EXCLUSION OR LIMITATION MAY NOT APPLY TO YOU AND YOU MAY ALSO HAVE OTHER LEGAL RIGHTS THAT VARY FROM STATE TO STATE.

Macromedia reserves the right, from time to time, to update the information in this document with current information.