Adobe ColdFusion (CVE-2011-0584) Session Fixation Vulnerability

Bugtraq ID:	46278
Class:	Design Error
CVE:	CVE-2011-0584
Remote:	Yes
Local:	No
Published:	Feb 08 2011 12:00AM
Updated:	Mar 08 2011 12:17AM
Credit:	Jason Dean of 12robots
Vulnerable:	Adobe ColdFusion 8.0.1 Adobe ColdFusion 9.0.1 Adobe ColdFusion 9.0 Adobe ColdFusion 8.0
Not Vulnerable:

Adobe ColdFusion (CVE-2011-0584) Session Fixation Vulnerability

Adobe ColdFusion is prone to a session-fixation vulnerability.

Very few details are available regarding this issue. We will update this BID as more information emerges.

Attackers can exploit this issue to hijack a user's session and gain unauthorized access to the affected application.

Adobe ColdFusion (CVE-2011-0584) Session Fixation Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim into following a malicious URI.

Adobe ColdFusion (CVE-2011-0584) Session Fixation Vulnerability

Solution:
Updates are available; please see the references for details.


Adobe ColdFusion 8.0

• Adobe CF8.zip
  http://kb2.adobe.com/cps/890/cpsid_89094/attachments/CF8.zip

Adobe ColdFusion 9.0

• Adobe CF9.zip
  http://kb2.adobe.com/cps/890/cpsid_89094/attachments/CF9.zip

Adobe ColdFusion 9.0.1

• Adobe CF901.zip
  http://kb2.adobe.com/cps/890/cpsid_89094/attachments/CF901.zip

Adobe ColdFusion 8.0.1

• Adobe CF801.zip
  http://kb2.adobe.com/cps/890/cpsid_89094/attachments/CF801.zip

Adobe ColdFusion (CVE-2011-0584) Session Fixation Vulnerability

References:

• Adobe ColdFusion Homepage (Adobe)
  
• APSB11-04: Security update: Hotfix available for ColdFusion (Adobe)