Skip to main content
R
RichardG
Inspiring
August 13, 2010
Answered

Security Hotfix APSB10-18 for MX7 ?

  • August 13, 2010
  • 1 reply
  • 1959 views

I just read about the the APSB10-18 Vulnerability (http://www.adobe.com/support/security/bulletins/apsb10-18.html).

Since it says it is "... identified in ColdFusion 9.0.1 and earlier versions for Windows..." does that mean version 7 has this vulerability as well?

If so, is there a patch for MX7 or do I need to upgrade?

If I need to upgrade, which would be the better choice - 8 or 9?

Many thanks in advance,

Richard

    This topic has been closed for replies.
    Correct answer JR__Bob__Dobbs

    Using Windows authentication is better than the default username/password security, but my preference is to only deploy the administrator directory when I need to make a change to the server (such as adding a data source ). I remove the directory when I'm done. I figure the administrator directory can't be hacked if it isn't on the server to begin with.

    If you choose windows authentication I would also recommend that you configure your active directory server to lock out users after multiple login attempts with an invalid password. This will reduce your vulnerability to brute force attacks.

    1 reply

    J
    JR__Bob__Dobbs
    Inspiring
    August 13, 2010

    It does not appear that CF7 is still supported by Adobe.  It is not listed as a supported product ( http://www.adobe.com/support/programs/policies/supported.html ).

    If you have the option to upgrade I would with go to the latest version of CF.

    Alternately you could work around the vulnerablilty by not deploying the CFIDE/Administrator directory to your production web servers.

    R
    RichardGAuthor
    Inspiring
    August 13, 2010

    Nuts.

    Do you think an acceptable alternative would be be to require Windows Authentication and disallow anonymous access to that directory (if I understand that correctly)?

    J
    JR__Bob__DobbsCorrect answer
    Inspiring
    August 13, 2010

    Using Windows authentication is better than the default username/password security, but my preference is to only deploy the administrator directory when I need to make a change to the server (such as adding a data source ). I remove the directory when I'm done. I figure the administrator directory can't be hacked if it isn't on the server to begin with.

    If you choose windows authentication I would also recommend that you configure your active directory server to lock out users after multiple login attempts with an invalid password. This will reduce your vulnerability to brute force attacks.

    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices