Allaire ColdFusion CFCRYPT.EXE Vulnerability
BID:275
Info
Allaire ColdFusion CFCRYPT.EXE Vulnerability
| Bugtraq ID: | 275 |
| Class: | Design Error |
| CVE: |
CVE-1999-0757 |
| Remote: | No |
| Local: | Yes |
| Published: | May 19 1998 12:00AM |
| Updated: | Jul 11 2009 12:16AM |
| Credit: | This vulnerability was publicized in Allaire Security Bulletin ASB99-08 on May 19, 1999 Exploit posted to Bugtraq by Matt Chapman <[email protected]> July 24, 1999 |
| Vulnerable: |
Allaire ColdFusion Server 4.0.1 Allaire ColdFusion Server 4.0 Allaire ColdFusion Server 3.1.2 Allaire ColdFusion Server 3.1.1 Allaire ColdFusion Server 3.1 Allaire ColdFusion Server 3.0.1 Allaire ColdFusion Server 3.0 |
| Not Vulnerable: | |
Discussion
Allaire ColdFusion CFCRYPT.EXE Vulnerability
A vulnerability in ColdFusion allows pages encrypted with the CFCRYPT.EXE utility to be decrypted.
ColdFusion supports the ability to "encrypt" the CFML templates in an application or component, using the CFCRYPT.EXE utility, so they can be redistributed or sold without exposing the source code to casual viewing. A program that decrypts ColdFusion's encryption has been discovered. This will in effect make the source code for all this propietary CFML applications available to those with access to their encrypted form.
A vulnerability in ColdFusion allows pages encrypted with the CFCRYPT.EXE utility to be decrypted.
ColdFusion supports the ability to "encrypt" the CFML templates in an application or component, using the CFCRYPT.EXE utility, so they can be redistributed or sold without exposing the source code to casual viewing. A program that decrypts ColdFusion's encryption has been discovered. This will in effect make the source code for all this propietary CFML applications available to those with access to their encrypted form.
Solution / Fix
Allaire ColdFusion CFCRYPT.EXE Vulnerability
Solution:
While SecurityFocus does not consider the following to be a sufficient solution, the Allaire Security Bulletin offers the following suggestion:
(Quoted verbatim from ASB99-08)
What Customers Should Do
In general, people using CFRYPT.EXE to hide source code should recognize that there is the possibility of pages being illegally decrypted. Customers who are creating commercial applications for redistribution or sale should include a license agreement that clearly states users are not authorized to decrypt encrypted pages. Organizations using CFCRYPT.EXE to protect code internally should recognize the risk that decoding may pose and adjust accordingly.
Solution:
While SecurityFocus does not consider the following to be a sufficient solution, the Allaire Security Bulletin offers the following suggestion:
(Quoted verbatim from ASB99-08)
What Customers Should Do
In general, people using CFRYPT.EXE to hide source code should recognize that there is the possibility of pages being illegally decrypted. Customers who are creating commercial applications for redistribution or sale should include a license agreement that clearly states users are not authorized to decrypt encrypted pages. Organizations using CFCRYPT.EXE to protect code internally should recognize the risk that decoding may pose and adjust accordingly.
References
Allaire ColdFusion CFCRYPT.EXE Vulnerability
References:
References: