Macromedia ColdFusion MX CFML Source Disclosure Vulnerability

Bugtraq ID:	6123
Class:	Configuration Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 07 2002 12:00AM
Updated:	Nov 07 2002 12:00AM
Credit:	Reported in a Macromedia Product Security Bulletin.
Vulnerable:	Macromedia ColdFusion Server MX Professional Macromedia ColdFusion Server MX Enterprise Macromedia ColdFusion Server MX Developer
Not Vulnerable:

Macromedia ColdFusion MX CFML Source Disclosure Vulnerability

When ColdFusion MX is installed on a webserver, the .jsp, .cfm, .cfc, and .cfml extensions are mapped to be processed by ColdFusion. If these file extensions were not correctly specified during installation, they may be served as static files by the webserver if ColdFusion is not running.

The ColdFusion Install Kit for all platforms correctly maps the extensions in question, however, instructions omit the -map switch for Unix platforms.

Macromedia ColdFusion MX CFML Source Disclosure Vulnerability

There is no exploit necessary.

Macromedia ColdFusion MX CFML Source Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Macromedia ColdFusion MX CFML Source Disclosure Vulnerability

References:

• MPSB02-13 - ColdFusion MX file extension mappings (Macromedia)