Adobe ColdFusion FCKeditor File Upload and Security Bypass Issues


Description   Multiple vulnerabilities have been identified in Adobe ColdFusion, which could be exploited by attackers to gain knowledge of sensitive information or compromise a vulnerable web server. These issues are caused by errors in FCKeditor. For additional information, see : FrSIRT/ADV-2009-1799
     
Vulnerable Products   Vulnerable Software:
Adobe ColdFusion version 8.0Adobe ColdFusion version 8.0.1
     
Solution   Upgrade to Adobe ColdFusion version 8.0.1 and apply hotfix : http://www.adobe.com/support/security/bulletins/downloads/hf801-77218.jar
     
CVE   CVE-2009-2265
     
References   http://www.adobe.com/support/security/bulletins/apsb09-09.html
     
Vulnerability Manager Detection   No
     
IPS Protection  
ASQ Engine alarm Available Since
Misc : Directory traversal - parameter starting with ../
3.2.0
Directory traversal using ..\..
3.2.0
Directory traversal
3.2.0
Directory traversal backward root folder
3.2.0
     


 
 
 
 
 Risk level 
High 

 Vulnerability First Public Report Date 
2009-07-08 

 Target Type 
Server 

 Possible exploit 
Local & Remote