Macromedia ColdFusion MX Remote File Content Disclosure Vulnerability

Bugtraq ID:	11331
Class:	Access Validation Error
CVE:	CVE-2004-0928
Remote:	Yes
Local:	No
Published:	Oct 05 2004 12:00AM
Updated:	Jul 12 2009 07:06AM
Credit:	The discoverer of this vulnerability wishes to remain anonymous.
Vulnerable:	Macromedia ColdFusion MX 6.1
Not Vulnerable:

Macromedia ColdFusion MX Remote File Content Disclosure Vulnerability

Macromedia ColdFusion MX is affected by a remote file content disclosure vulnerability. This vulnerability is caused by access validation issue that allows an attacker to bypass protections to reveal the contents of files.

It should be noted that this issue does not reveal directory contents, therefore attackers must have prior knowledge of target files.

An attacker may leverage this issue to read the contents of files contained under the webroot directory that are readable by the ColdFusion process on the affected computer; affectively bypassing access restrictions set in the IIS management system.

Macromedia ColdFusion MX Remote File Content Disclosure Vulnerability

No exploit is required to leverage this issue.

Macromedia ColdFusion MX Remote File Content Disclosure Vulnerability

Solution:
The vendor has released a patch that resolves this issue.


Macromedia ColdFusion MX 6.1

• Macromedia MPSB04-09 - Cumulative Security Patch available for ColdFusion MX
  http://www.macromedia.com/devnet/security/security_zone/mpsb04-09.html

Macromedia ColdFusion MX Remote File Content Disclosure Vulnerability

References:

• ColdFusion MX Home Page (Macromedia)
  
• iDEFENSE Security Advisory 10.05.04a: ColdFusion MX 6.1 on IIS File Disclosure (iDEFENSE)
  
• MPSB04-09 - Cumulative Security Patch available for ColdFusion MX (Macromedia)