PT-2002-1626 · Adobe · Coldfusion

Published 2002-06-18 · Updated 2008-09-05 · CVE-2002-0576

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ColdFusion versions 5.0 and earlier

Description The issue allows remote attackers to determine the absolute pathname of certain files, such as .cfm or .dbm files, on Windows systems. This is achieved through an HTTP request containing an MS-DOS device name, like NUL, which results in the pathname being leaked in an error message.

Recommendations For ColdFusion versions 5.0 and earlier, consider restricting access to sensitive files and directories to minimize the risk of exploitation until a fix is available. As a temporary workaround, avoid using MS-DOS device names in HTTP requests to prevent pathname leakage.

Fix

Related Identifiers

CVE-2002-0576

Affected Products

Coldfusion

References · 7

• http://macromedia.com/v1/handlers/index.cfm?ID=22906 · Vendor Advisory
• http://iss.net/security_center/static/8866.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0576 · Security Note
• http://securityfocus.com/bid/4542 · Vendor Advisory
• http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0028.html · Note
• http://online.securityfocus.com/archive/1/268263 · Note
• http://osvdb.org/3337 · Note