Adobe Warns of Attacks Exploiting ColdFusion Vulnerabilities, Fix Coming

Adobe on Thursday issued a security advisory for ColdFusion customers related to three vulnerabilities affecting ColdFusion running on Windows, Mac OS and UNIX platforms, adding that the vulnerabilities are being exploited in attacks.

The security issues impact ColdFusion 10, 9.0.2, 9.0.1 and 9.0 for Windows, Mac OS X and UNIX, and if exploited, could let an attacker remotely bypass authentication controls, access to restricted directories, and leak data from a compromised server.

Late Friday night, Adobe’s Product Security Incident Response Team (PSIRT) announced that a fix is in the works and that customers should expect a hotfix for ColdFusion 10, 9.0.2, 9.0.1 and 9.0 on January 15, 2013.

The three vulnerabilities affecting ColdFusion for Windows, Macintosh and UNIX include:

• CVE-2013-0625 affects ColdFusion 10, 9.0.2, 9.0.1 and 9.0, and could permit an unauthorized user to remotely circumvent authentication controls, potentially allowing the attacker to take control of the affected server.

• CVE-2013-0629 affects ColdFusion 10, 9.0.2, 9.0.1 and 9.0, and could permit an unauthorized user access to restricted directories.

• CVE-2013-0631 affects ColdFusion 9.0.2, 9.0.1 and 9.0, and could result in information disclosure from a compromised server.

According to Adobe, CVE-2013-0625 and CVE-2013-0629 only affect ColdFusion customers who do not have password protection enabled or have no password set.

Additional details, including mitigation guidance for customers is available in the ColdFusion security advisory. 

Adobe on Thursday also said they would release an update coinciding with Microsoft Patch Tuesday to fix critical vulnerabilities affecting Adobe Reader and Acrobat. The security updates, set to be released on Jan. 8, will address issues in Adobe Reader and Acrobat XI (11.0.0) and earlier versions for Windows and Macintosh, as well as Adobe Reader 9.5.1 and earlier 9.x versions for Linux.