Accessibility

Security Bulletin

MPSB04-06 - Security Patch available for ColdFusion MX 6.1 File Upload Denial of service

Originally posted: April 15, 2004

Summary

ColdFusion MX 6.1 is vulnerable to a denial of service attack if a malicious user repeatedly uploads files and interrupts each upload before it completes.

Solution

Macromedia has released a File Upload DoS patch that can be downloaded and applied to ColdFusion MX 6.1.

Affected Software Versions

  • ColdFusion MX 6.1 (all editions)
  • ColdFusion MX 6.1 J2EE (all editions)
  • ColdFusion MX 6.1 J2EE (all editions)

Severity Rating

Macromedia categorizes this issue as a important update and recommends users immediately patch their ColdFusion MX installation.

Details

When file uploads to ColdFusion MX via an HTML form are started, but are interrupted before they complete - disk space on the server may not be reclaimed when the ColdFusion MX template finishes processing.

Making the Changes

Note: Back up your existing files before making changes. As always, test the changes in a non-production environment before applying the changes to production servers.

ColdFusion MX 6.0

  1. Upgrade to ColdFusionMX 6.1
  2. Follow the instructions for making the changes for ColdFusionMX 6.1 below.

ColdFusion MX 6.1 Enterprise or Standard Edition

  1. Download the patch above and expand it
  2. Stop ColdFusion MX
  3. Place the hf52806_61.jar in the {cf_root}/runtime/servers/lib directory. (Create the {cf_root}/runtime/servers/lib directory if it does not exist.)
  4. Start ColdFusion MX

ColdFusion MX 6.1 J2EE on Other J2EE Servers

  1. Stop ColdFusion MX

  2. Place the hf52806_61.jar in the directory according to the J2EE server:

    • ColdFusion MX for J2EE (WebLogic 7 shown)
      /Bea/WebLogic700/server/bin/applications/cfusion.ear/cfusion.war/WEB-INF/lib
    • ColdFusion MX for J2EE (Websphere)
      /WebSphere/AppServer/installedApps/cfusion.ear/cfusion.war/WEB-INF/lib
    • ColdFusion MX for J2EE (SunOne)
      /iPlanet/Servers/docs/CFusionMX/WEB-INF/lib
    • ColdFusion MX for J2EE (JRun)
      /jrun4/servers/lib
  3. Start ColdFusion MX

Note: Back up your existing files before making changes. As always, test the changes in a non-production environment before applying the changes to production servers.

Acknowledgements

Macromedia would like to thank Chip Self of Tiffworks.com for reporting this vulnerability and for working with us to help protect our customers' security.

Revisions

April 15, 2004 - Bulletin first created.
April 20, 2004 - Bulletin amended.

Reporting Security Issues

Macromedia is committed to addressing security issues and providing customers with the information on how they can protect themselves. If you identify what you believe may be a security issue with a Macromedia product, please send an email to secure@macromedia.com.We will work to appropriately address and communicate the issue.

Receiving Security Bulletins

When Macromedia becomes aware of a security issue that we believe significantly affects our products or customers, we will notify customers when appropriate. Typically this notification will be in the form of a security bulletin explaining the issue and the response. Macromedia customers who would like to receive notification of new security bulletins when they are released can sign up for our security notification service.

For additional information on security issues at Macromedia, please visit: http://www.macromedia.com/security.

ANY INFORMATION, PATCHES, DOWNLOADS, WORKAROUNDS OR FIXES PROVIDED BY MACROMEDIA IN THIS BULLETIN ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MACROMEDIA AND ITS SUPPLIERS DISCLAIM ALL WARRANTIES, WHETHER EXPRESS OR IMPLIED OR OTHERWISE, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. ALSO, THERE IS NO WARRANTY OF NON-INFRINGEMENT, TITLE OR QUIET ENJOYMENT. (USA ONLY) SOME STATES DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES, SO THE ABOVE EXCLUSION MAY NOT APPLY TO YOU.

IN NO EVENT SHALL MACROMEDIA, INC. OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING, WITHOUT LIMITATION, DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, PUNITIVE, COVER, LOSS OF PROFITS, BUSINESS INTERRUPTION OR THE LIKE, OR LOSS OF BUSINESS DAMAGES, BASED ON ANY THEORY OF LIABILITY INCLUDING BREACH OF CONTRACT, BREACH OF WARRANTY, TORT(INCLUDING NEGLIGENCE), PRODUCT LIABILITY OR OTHERWISE, EVEN IF MACROMEDIA, INC. OR ITS SUPPLIERS OR THEIR REPRESENTATIVES HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. (USA ONLY) SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES, SO THE ABOVE EXCLUSION OR LIMITATION MAY NOT APPLY TO YOU AND YOU MAY ALSO HAVE OTHER LEGAL RIGHTS THAT VARY FROM STATE TO STATE.

Macromedia reserves the right, from time to time, to update the information in this document with current information.