Adobe ColdFusion Local Information Disclosure and Local Privilege Escalation Vulnerability

Bugtraq ID:	32130
Class:	Unknown
CVE:	CVE-2008-4831
Remote:	No
Local:	Yes
Published:	Nov 06 2008 12:00AM
Updated:	Nov 07 2008 04:45PM
Credit:	Jochem van Dieten
Vulnerable:	Adobe ColdFusion MX 7.02 Adobe ColdFusion 8.0.1 Adobe ColdFusion 8
Not Vulnerable:

Adobe ColdFusion Local Information Disclosure and Local Privilege Escalation Vulnerability

Adobe ColdFusion is prone to a local vulnerability that can allow attackers to escalate privileges and obtain sensitive information.

Local attackers can exploit this issue to bypass sandbox security restrictions, particularly in shared-hosting environments, to access sensitive information or elevate privileges. A successful exploit could completely compromise affected computers.

ColdFusion 8, 8.0.1 and ColdFusion MX 7.0.2 Solution are vulnerable.

Adobe ColdFusion Local Information Disclosure and Local Privilege Escalation Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Adobe ColdFusion Local Information Disclosure and Local Privilege Escalation Vulnerability

Solution:
The vendor has released an advisory and fixes. Please see the references for more information.


Adobe ColdFusion 8

• Adobe hf800-73122.jar
  http://www.adobe.com/support/security/bulletins/downloads/hf800-73122. jar

Adobe ColdFusion 8.0.1

• Adobe hf801-73122.jar
  http://www.adobe.com/support/security/bulletins/downloads/hf801-73122. jar

Adobe ColdFusion Local Information Disclosure and Local Privilege Escalation Vulnerability

References:

• Adobe ColdFusion Homepage (Adobe)
  
• APSB08-21 Update available for potential ColdFusion 8 privilege escalation issue (Adobe)