Macromedia ColdFusion MX CreateObject And CFOBJECT Java Extensibility Weakness

Bugtraq ID:	11364
Class:	Configuration Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 12 2004 12:00AM
Updated:	Oct 12 2004 12:00AM
Credit:	Eric Lackey <[email protected]> disclosed this vulnerability.
Vulnerable:	Macromedia ColdFusion MX 6.1 Macromedia ColdFusion MX 6.0
Not Vulnerable:

Macromedia ColdFusion MX CreateObject And CFOBJECT Java Extensibility Weakness

It is reported that ColdFusion MX contains a weakness that allows all developers to utilize the CFOBJECT tag and the CreateObject function to execute potentially malicious code in the context of the affected application server.

This weakness allows malicious developers to execute code that is not appropriate for a shared server environment, or to perform administrative actions in the context of the affected application server. Malicious developers may possibly exploit this weakness to aid them in further application or system attacks.

Versions 6.0 and 6.1 of Macromedia ColdFusion MX are reported to be affected by this weakness.

Macromedia ColdFusion MX CreateObject And CFOBJECT Java Extensibility Weakness

An exploit is not required.

Macromedia ColdFusion MX CreateObject And CFOBJECT Java Extensibility Weakness

Solution:
The vendor has released advisory MPSB04-10 to address this issue. Please see the referenced advisory for further information.

Macromedia ColdFusion MX CreateObject And CFOBJECT Java Extensibility Weakness

References:

• ColdFusion MX Home Page (Macromedia)
  
• MPSB04-10 - The CFOBJECT tag and CreateObject functions should be secured in a s (Macromedia)
  
• CFMX vulnerability (Eric Lackey )