PT-2005-5031 · Adobe · Coldfusion Mx

Published 2005-12-17 · Updated 2011-03-08 · CVE-2005-4344

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion MX version 7.0

Description The issue concerns a configuration setting where the CFOBJECT /CreateObject(Java) setting is not honored when disabled. This allows local users to create an object despite the specified configuration, potentially leading to unauthorized actions.

Recommendations For Adobe ColdFusion MX version 7.0, consider disabling the CreateObject(Java) function until a proper configuration setting is implemented to honor the disabled state of CFOBJECT. Restrict access to the CFOBJECT setting to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-4344

Affected Products

Coldfusion Mx

References · 6

• http://secunia.com/advisories/18078 · Vendor Advisory
• http://securitytracker.com/id?1015371 · Vendor Advisory
• http://securityfocus.com/bid/15904 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2005-4344 · Security Note
• http://macromedia.com/devnet/security/security_zone/mpsb05-14.html · Patch
• http://vupen.com/english/advisories/2005/2948 · Note