Post ColdFusion Security Hotfix APSB13-10 - Administrator no longer accessible

[Fullertj]

Hello,

I installed the CF hotfix APSB13-10 hotfix to my CF 9.00 installation.  I am aware of the three different versions for 9.01 and 9.02 and used the version for 9.00.  In addition, as I had already installed the previous security patch, I used the version that was designed for that.

However, after patching I can no longer view the CF Admin.  The page renders, but is blank and only has the following HTML:

[Ok, I can't paste it, but basically it's all empty tags for HTML, HEAD, and BODY tags.]

The websites that run on my server are functioning okay, but obviously without the CF admin I will have trouble in the future if I need to make any changes.

In addition, backing out the changes did NOT fix this, so at this point I am stuck. 

I am running MS Server 2003 R2 with IIS 6.

Does anyone have any suggestions for this?

[Priyank Shrivastava.]

Hi,

First, can you please roll back the security hotfix. Remove the hf900-00010.jar from the \lib\updates folder or if you took the backup of the previous updates jar files replace with them, and then replace the CFIDE folder to the backed up foder, restart the server and then check if you can access the Admin.

If you have a Dev server, first apply the update on that one as you have already applied the security hotfix 13-03, then you have to follow the section 1 and check it.

Regards,

Priyank

[Fullertj]

Hello,

I followed your directions and now the CF Admin is working again, thank you.  However, what can I do to install this hotfix and secure my server?

[Priyank Shrivastava.]

Hi,

Can you please let me know if it is Server installation or Multi Server installation?

Regards,

Priyank

[Fullertj]

This is a Multi Server installation.  Our CF folders are:

C:\JRun4\servers\cfusion\cfusion-ear\cfusion-war\WEB-INF\cfusion\lib\updates

and

C:\Inetpub\wwwroot\cfide