Security hotfix APSB11-04 - CF8 and log4j.properties

[INTERNAL_SYSTEMS]

Hi,

I have been reviewing the Tech Notes for the security hotfix at http://kb2.adobe.com/cps/890/cpsid_89094.html which for CF 8.01 talks about backing up and replacing the   log4j.properties file. I can't locate this on any of our CF 8.01 servers, so wondering if this is a mistake in the tech note and should have only applied to CF 9. Can I skip the step all together or do I still need to copy the file from the downloaded hotfix to the suggested location?

Thanks

Meint

[carl type3]

Hi Meint,

My CF8.0.1 does not have log4j.properties file either tho CF9.0.1 has.

HTH, Carl.

[Charlie Arehart]

Yep, I can confirm the same. Seems to be a problem with the notes for 8.0.1 (I'll bet someone just was doing a copy/paste from the later releases that do have it.) Fortunately, it's just that you needn't bother to back it up first. I'll assume it's in fact correct that it gives the new file as part of the update.

I'd only applied the hf to a 9.0.1 server so had not noticed this yet myself. Thanks for sharing, Meint.

/charlie

[INTERNAL_SYSTEMS]

Thanks for your responses (even though Charlie's doesn't show for me apart from in the RSS feed), I will dive in, make appropriate backups, skip the step of backing up log4j.properties and assume that the inclusion of the file is as intended. Good thing Adam has confirmed patching in CF X will be easier, the current mix of update rollups and security fixes is a bit of a mess and the Tech Notes are often ambigious or not relevant to the platform that is being described. To me, this is big downside of using CF, keeping your security and stability up to date should really be much easier.

Meint