[Snort-sigs] Documentation: SID 906

Darryl Davidson ddavidson at ...1674...
Tue Jul 22 15:33:28 EDT 2003


Rule:

WEB-COLDFUSION Email example app getfile.cfm access

--
Sid:

906

--
Summary:

ColdFusion (Macromedia, formerly Allaire) web servers have several
default Example applications installed that have vulnerabilities.  The
email application can be exploited to allow remote viewing of arbitrary
files.

--
Impact:

Serious: The vulnerability is not limited to files in the webspace, so
system files or additional unexecuted code files could be retrieved and
examined for vulnerabilities.

--
Detailed Information:


--
Affected Systems:

ColdFusion versions 2.x, 3.x, 4.x for Windows
ColdFusion versions 4.x for Solaris, HP-UX
ColdFusion versions 4.5.x for Linux

--
Attack Scenarios:

The example application file cfdocs/exampleapp/email/getfile.cfm can 
accept URL-mangled requests like:

http://www.server.com/cfdocs/exampleapp/email/getfile.cfm?filename=c:\boot.ini

This allows trivial remote retrieval of any file on the server.

--
Ease of Attack:

Trivial

--
False Positives:

If you're using ColdFusion's example application, you'll trigger this Alert.

--
False Negatives:

Unknown

--
Corrective Action:

Delete all example code.  This is one of several significant
vulnerabilities that are exploitable if the example code is left on a
production server.

--
Contributors:

Documentation - Darryl Davidson <ddavidson at ...1674...>

-- 
Additional References:

CAN-2001-0535
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0535

http://xforce.iss.net/xforce/xfdb/6791

Macromedia Security Bulletin (MPSB01-08)
http://www.macromedia.com/devnet/security/security_zone/mpsb01-08.html









More information about the Snort-sigs mailing list