full-disclosure - New vulnerabilities in Adobe ColdFusion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Sun, 19 Jun 2011 21:24:26 +0300
From: "MustLive" <mustliveua@...il.com>
To: <submissions@...ketstormsecurity.org>, <full-disclosure@...ts.grok.org.uk>
Subject: New vulnerabilities in Adobe ColdFusion

Hello list!

I want to warn you about new security vulnerabilities in Adobe ColdFusion
(to previous SQL DB Structure Extraction, Full path disclosure and
Cross-Site Scripting). These are Brute Force and Abuse of Functionality
vulnerabilities.

-------------------------
Affected products:
-------------------------

Vulnerable are Adobe ColdFusion 9 and previous versions.

----------
Details:
----------

Brute Force (WASC-11):

http://site/CFIDE/administrator/

There is no protection from Brute Force attacks.

Abuse of Functionality (WASC-42):

http://site/CFIDE/administrator/

The administrator's login is fixed - it's login "admin" and it's set in
authentication form. Which greatly simplify Brute Force attacks (because
there is no need to enumerate logins, just need to enumerate password for
single login). In ColdFusion 7 and previous versions there is no login field
at all, only password field, which as well simplify Brute Force attacks.

As I found, Brute Force vulnerability was already informed to Adobe in 2008
(CVE-2008-1203) and they officially fixed it. But Abuse of Functionality
vulnerability still exists in the latest versions of ColdFusion. As I
checked in admin panel of 9 version and as I expected (after I've read
description of how Adobe fixed this vulnerability), the fix is ineffective -
because Adobe only added logging of failed login attempts (in patches for
versions MX7 and 8 and made in 9), but there was no and there is no
protection against BF.

------------
Timeline:
------------

2011.03.23 - announced at my site.
2011.04.08 - informed developers.
2011.06.15 - disclosed at my site.

I mentioned about these vulnerabilities at my site
(http://websecurity.com.ua/5029/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/