PT-2012-2857 · Adobe · Coldfusion

Published 2012-03-13 · Updated 2018-01-11 · CVE-2012-0770

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions 8.0 through 9.0.1

Description The issue allows remote attackers to cause a denial of service by sending many crafted parameters, resulting in CPU consumption due to hash collisions.

Recommendations For Adobe ColdFusion versions 8.0 through 9.0.1, consider implementing restrictions on the number of form parameters that can be submitted to prevent predictable hash collisions and subsequent denial of service attacks.

Fix

Related Identifiers

CVE-2012-0770

Affected Products

Coldfusion

References · 8

• http://adobe.com/support/security/bulletins/apsb12-06.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0770 · Security Note
• http://secunia.com/advisories/48393 · Note
• http://helpx.adobe.com/coldfusion/kb/coldfusion-security-hotfix.html · Note
• http://osvdb.org/80008 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0770 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73955 · Note
• http://securitytracker.com/id?1026830 · Note