Macromedia ColdFusion Lets Remote Users Deny Service By Sending Many Form Fields
|
|
SecurityTracker Alert ID: 1008878
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jan 28 2004
|
Impact: Denial of service via network
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): MX 6.1 (all editions), MX 6.1 J2EE (all editions)
|
Description: A vulnerability was reported in Macromedia ColdFusion in the processing of form fields. A remote user can cause denial of service conditions on the target system.
It is reported that a remote user can submit a bogus request containing a large number (e.g., several hundred) of form fields to
cause ColdFusion MX 6.1 to take an excessive amount of time to process the request.
Macromedia has assigned an "Important" severity
rating to this flaw.
Macromedia credits Michael Leahy of Grand Valley State University with reporting this vulnerability.
|
Impact: A remote user can cause the target ColdFusion service to consume an excessive amount of time processing a malicious request.
|
Solution: The vendor has released a Form fields DoS patch (19 KB ZIP), available at:
http://download.macromedia.com/pub/security/mpsb04-02.zip
See
the vendor's advisory for installation instructions, available at:
http://www.macromedia.com/devnet/security/security_zone/mpsb04-02.html
|
Vendor URL: www.macromedia.com/devnet/security/security_zone/mpsb04-02.html (Links to External Site)
|
Cause: Exception handling error, Resource error
|
Underlying OS: Linux (Any), UNIX (HP/UX), UNIX (Solaris - SunOS), Windows (NT), Windows (2000), Windows (XP)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 28 Jan 2004 16:26:54 -0500
Subject: http://www.macromedia.com/devnet/security/security_zone/mpsb04-02.html
|
http://www.macromedia.com/devnet/security/security_zone/mpsb04-02.html
> MPSB04-02 Security Patch available for ColdFusion MX 6.1 form fields Denial of service
Macromedia reported that a remote user can submit a bogus request containing a large
number (e.g., several hundred) of form fields to cause ColdFusion MX 6.1 to take an
excessive amount of time to process the request.
A Form fields DoS patch (19 KB ZIP) is available:
http://download.macromedia.com/pub/security/mpsb04-02.zip
See the vendor's advisory for installation instructions.
Macromedia credits Michael Leahy of Grand Valley State University with reporting this
vulnerability.
|
|
