To solve the Hotfix issue

Report · Oct 22, 2012

Hi,

I am using CF-MX7 for my application and when i run the application for PCI scanning, they have given report to us regarding hotfix issue. I have search online and got a solution to solve the hotfix issue like, to add a chf700003.jar file in server using coldfusion administrator page->system information.(pls.refer this URL: http://helpx.adobe.com/coldfusion/kb/coldfusion-mx-7-cumulative-hot.html)

I have choosen my downloaded file and click the submit button and it display the message "server updated successfully". After restarting the coldfusion, i have checked the system information(Administrator->System Information) details and there is no file name is available.

Please let me know if any i missed out for doing updation otherwise any other solution available for solve the hotfix issue.

Thanks in Advance.

Regards,

Samsul Hudha .M.Y

Report · Oct 22, 2012

Most likely the vulnerability is referring to admin templates and scripts in the CFIDE directory. If so you can do the following and it works on all versions from CF5 to 10:

Create an empty directory on your server, I name it CFIDE_empty.
Go into your web server administration and navigate to your site.
Delete the current CFIDE virtual directory -- make sure it is a virtual directory and not the real CFIDE that is usually attacked to the default site.
Create a new CFIDE virtual directory and point it to the empty directory you created in step 1.
On this CFIDE virtual directory, create another virtual directory names scripts and point it back to the original CFIDE/scripts directory.

Vulnerability should go away -- if it is the CFIDE-admin one.

Report · Oct 23, 2012

Hi,

Thanks for your reply,

Actually i am new to coldfusion and i am not clear about your third point that, how can i find the CFIDE virtual directory and also and how can i create a new virtual directory.

Is there any videos links available?

Please guide me to move further.

Regards,

Samsul Hudha .M.Y