Allaire ColdFusion Security Sandbox CFEXECUTE Privilege Escalation Vulnerability
BID:3604
Info
Allaire ColdFusion Security Sandbox CFEXECUTE Privilege Escalation Vulnerability
| Bugtraq ID: | 3604 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 27 2001 12:00AM |
| Updated: | Nov 27 2001 12:00AM |
| Credit: | Published in Macromedia Product Security Bulletin (MPSB01-11). |
| Vulnerable: |
Allaire ColdFusion Server 5.0 Allaire ColdFusion Server 4.5 |
| Not Vulnerable: | |
Discussion
Allaire ColdFusion Security Sandbox CFEXECUTE Privilege Escalation Vulnerability
ColdFusion 4.5 includes Sandbox Security which restricts applications to secure Server Sandboxes, in order to control application access to directories, components, databases, or other resources on the server.
CFEXECUTE is a tag that calls a requested program and waits for the output. The CFOBJECT tag allows you to call methods in COM and CORBA objects. Processes created by CFEXECUTE or CFOBJECT use the 'Windows CreateProcess()' function.
A vulnerability exists in ColdFusion which could allow arbitrary programs to inherit the security settings of ColdFusion SYSTEM privileges, rather than the security context of Sandbox security.
ColdFusion 4.5 includes Sandbox Security which restricts applications to secure Server Sandboxes, in order to control application access to directories, components, databases, or other resources on the server.
CFEXECUTE is a tag that calls a requested program and waits for the output. The CFOBJECT tag allows you to call methods in COM and CORBA objects. Processes created by CFEXECUTE or CFOBJECT use the 'Windows CreateProcess()' function.
A vulnerability exists in ColdFusion which could allow arbitrary programs to inherit the security settings of ColdFusion SYSTEM privileges, rather than the security context of Sandbox security.
Exploit / POC
Allaire ColdFusion Security Sandbox CFEXECUTE Privilege Escalation Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Allaire ColdFusion Security Sandbox CFEXECUTE Privilege Escalation Vulnerability
Solution:
Macromedia suggests that Sandbox Security users disable <CFEXECUTE> tag and to review user written software accessed via the <CFOBJECT> as well as their installed CFX extensions.
Solution:
Macromedia suggests that Sandbox Security users disable <CFEXECUTE> tag and to review user written software accessed via the <CFOBJECT> as well as their installed CFX extensions.