Security Experts:

Adobe Warns of Attacks Exploiting ColdFusion Vulnerabilities, Fix Coming

Adobe on Thursday issued a security advisory for ColdFusion customers related to three vulnerabilities affecting ColdFusion running on Windows, Mac OS and UNIX platforms, adding that the vulnerabilities are being exploited in attacks.

The security issues impact ColdFusion 10, 9.0.2, 9.0.1 and 9.0 for Windows, Mac OS X and UNIX, and if exploited, could let an attacker remotely bypass authentication controls, access to restricted directories, and leak data from a compromised server.

Late Friday night, Adobe’s Product Security Incident Response Team (PSIRT) announced that a fix is in the works and that customers should expect a hotfix for ColdFusion 10, 9.0.2, 9.0.1 and 9.0 on January 15, 2013.

The three vulnerabilities affecting ColdFusion for Windows, Macintosh and UNIX include:

CVE-2013-0625 affects ColdFusion 10, 9.0.2, 9.0.1 and 9.0, and could permit an unauthorized user to remotely circumvent authentication controls, potentially allowing the attacker to take control of the affected server.

CVE-2013-0629 affects ColdFusion 10, 9.0.2, 9.0.1 and 9.0, and could permit an unauthorized user access to restricted directories.

CVE-2013-0631 affects ColdFusion 9.0.2, 9.0.1 and 9.0, and could result in information disclosure from a compromised server.

According to Adobe, CVE-2013-0625 and CVE-2013-0629 only affect ColdFusion customers who do not have password protection enabled or have no password set.

Additional details, including mitigation guidance for customers is available in the ColdFusion security advisory

Adobe on Thursday also said they would release an update coinciding with Microsoft Patch Tuesday to fix critical vulnerabilities affecting Adobe Reader and Acrobat. The security updates, set to be released on Jan. 8, will address issues in Adobe Reader and Acrobat XI (11.0.0) and earlier versions for Windows and Macintosh, as well as Adobe Reader 9.5.1 and earlier 9.x versions for Linux. 

view counter
For more than 10 years, Mike Lennon has been closely monitoring the threat landscape and analyzing trends in the National Security and enterprise cybersecurity space. In his role at SecurityWeek, he oversees the editorial direction of the publication and is the Director of several leading security industry conferences around the world.