SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |    Help    |   

SecurityTracker
Archives


Issue multiple certificates with Thawte SPKI
 
Click to Sign Up
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com
Sign Up!





Category:  Application (Web Server/CGI)  >  ColdFusion Vendors:  Macromedia
Macromedia ColdFusion MX Server Discloses Installation Path to Remote Users
SecurityTracker Alert ID:  1006650
CVE Reference:  GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Apr 26 2003
Impact:  Disclosure of system information
Exploit Included:  Yes   Vendor Confirmed:  Yes  
Advisory:  Network Intelligence India
Version(s): MX
Description:  An information disclosure vulnerability was reported in the Macromedia ColdFusion MX Server. A remote user can determine the installation path.

Network Intelligence India Pvt. Ltd. reported that a remote user can query the administrative server on TCP port 8500 with a certain URL to determine the installation path of the software. The query will result in an error message that discloses the installation path.

A demonstration exploit URL is provided:

http://[target]:8500/CFIDE/probe.cfm

[Editor's note: The original advisory from NII cannot be included in this Alert due to copyright restrictions. The original advisory is available at: http://www.nii.co.in/vuln/pdmac.html]
Impact:  A remote user can determine the installation path.
Solution:  The vendor has reportedly indicated that the 'Debugging Settings' page in the Administrator console can be configured to suppress the installation path information that is displayed in the error message. To do so, you can reportedly check 'Enable Robust Exception Information.'
Vendor URL:  www.macromedia.com/software/coldfusion/ (Links to External Site)
Cause:  Access control error
Underlying OS:  Windows (NT), Windows (2000), Windows (XP)
Underlying OS Comments:  Confirmed on Windows 2000
Reported By:  "Network Intelligence India Pvt. Ltd." <info@nii.co.in>
Message History:   None.

 Source Message Contents

 

[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page



Home   |    View Topics   |    Search   |    Contact Us   |    Help

Copyright 2002, SecurityGlobal.net LLC