Known Participant

Question

CVE-2009-1872 Hotfix Incorrect Instructions??

Forum|Forum|16 years ago
August 23, 2009
1 reply
2072 views

The instructions for CVE-2009-1872, CVE-2009-1877 located here:

http://download.macromedia.com/pub/coldfusion/updates/ReadMe_1872_1877.txt

It says clearly on step 4 that:

"4) From the downloaded CFIDE copy cf_debugFr.cfm to <cfwebroot>\CFIDE\debug\ and _logintowizard.cfm to <cfwebroot>\CFIDE\wizards\common."

I have downloaded the archive in question twice from:

http://download.macromedia.com/pub/coldfusion/updates/702/CF7.0.2.zip

and the file is missing the \wizards\ folder and of course the _logintowizard.cfm file.

Adobe, what do I do here?

ReadMe_1872_1877.txt

This topic has been closed for replies.

Inspiring

http://download.macromedia.com/pub/coldfusion/updates/8/CFIDE-8.zip

This has the missing file.

Discussion can be found here:

http://forta.com/blog/index.cfm/2009/8/17/ColdFusion-And-JRun-Security-Hotfixes-Posted#c4DCF8A94-3048-80A9-EF9B6E8116427611

Known Participant

But will this address the 7.x servers as well? The archive indicates 8.x servers.

Isn't Adobe going to fix this? If this is a serious security risk, why isn't there a complete patch file that will fix it? I'm wondering if Adobe monitors these forums at all?

Participant

The Adobe ZIP has been fixed and now includes both cf_debugFr.cfm and _logintowizard.cfm:

http://download.macromedia.com/pub/coldfusion/updates/702/7_0_2.zip

http://www.adobe.com/support/security/bulletins/apsb09-12.html