CVE-2009-1872 Hotfix Incorrect Instructions??

[bmelendy]

The instructions for CVE-2009-1872, CVE-2009-1877 located here:

http://download.macromedia.com/pub/coldfusion/updates/ReadMe_1872_1877.txt

It says clearly on step 4 that:

"4) From the downloaded CFIDE copy cf_debugFr.cfm to <cfwebroot>\CFIDE\debug\ and _logintowizard.cfm to <cfwebroot>\CFIDE\wizards\common."

I have downloaded the archive in question twice from:

http://download.macromedia.com/pub/coldfusion/updates/702/CF7.0.2.zip

and the file is missing the \wizards\ folder and of course the _logintowizard.cfm file.

Adobe, what do I do here?

[DaveF67]

http://download.macromedia.com/pub/coldfusion/updates/8/CFIDE-8.zip

This has the missing file.

Discussion can be found here:

http://forta.com/blog/index.cfm/2009/8/17/ColdFusion-And-JRun-Security-Hotfixes-Posted#c4DCF8A94-3048-80A9-EF9B6E8116427611

[bmelendy]

But will this address the 7.x servers as well?  The archive indicates 8.x servers.

Isn't Adobe going to fix this?  If this is a serious security risk, why isn't there a complete patch file that will fix it?  I'm wondering if Adobe monitors these forums at all?

[Ubqtous-ccgIFR]

The Adobe ZIP has been fixed and now includes both cf_debugFr.cfm and _logintowizard.cfm:

http://download.macromedia.com/pub/coldfusion/updates/702/7_0_2.zip

http://www.adobe.com/support/security/bulletins/apsb09-12.html

[rmalle01]

The link to download the zip for this update does not work.  Can you provide a new one?