There is no way to tell using the version number alone, they do not update the version number when you apply security hotfixes. To know for sure if all your hotfixes are applied you need to look at the lib\updates folder to see what jar files are in there, you may have applied some security hotfixes but not the cumulative hotfixes, etc. Plug -- My company has a product HackMyCF that can show you excactlly what patches are missing, etc. Here's an example for a 9.0.1 server: https://foundeo.com/hack-my-cf/example-report.cfm ... View more

Login to the ColdFusion administrator and click on "Java and JVM" under "Server Settings" on the left nav. Then update the Java Virtual Machine Path to point to the JVM that you just installed, for example "C:/Program Files/Java/jdk1.7.X_XX/jre" ... View more

Can you add throwonerror=false to the cfhttp tag, and then cfdump the #result# variable - there is probably some more info in the http response besides the 500 internal server error that might help you out. ... View more

You can use the java system property java.username: <cfset sys = CreateObject("java", "java.lang.System")> <cfset cfusername = sys.getProperty("user.name")> -- Pete Freitag Foundeo Inc - Makers of HackMyCF & FuseGuard ... View more

You might want to create a symbolic link for httpd.conf to point to the apache2.conf ... View more

It is used by the CF10/tomcat IIS connector. I have found that if you block access to the virtual directory it will prevent CF from executing as well. You will find that the connector will block direct access to the log files, and whatnot in the directory automatically for you. Try hitting each file in there to make sure you can't access anything you don't want public. ... View more

It is possible that they made a mistake when installing the updates, one of the things that our HackMyCF service checks for in the commercial version is hotfix installation errors, so we often see cases where user error in installing the hotfix can lead to other issues. -- Pete Freitag Foundeo Inc. Makers of HackMyCF & FuseGuard ... View more

Do you need to replicate the sessions, you may be able to use sticky sessions with better results. ... View more

If you are looking to have just two additional web servers and a single CF server - you can launch two more linux server instance (does not need to be a ColdFusion AMI, you can use the Amazon Linux AMI for example). Then copy the contents of the /opt/coldfusion10/config/wsconfig/1/ folder over to the new linux servers. In that directory edit the workers.properties file and change the line that says worker.cfusion.host=localhost To something like this: worker.cfusion.host=ip.of.your.cf.server Make sure the firewalls allow traffic to the port specified in this file from the web servers. Next copy the /etc/httpd/conf/mod_jk.conf file from the CF server on to the web server, and add that to you httpd.conf (eg add Include mod_jk.conf, or put the file in a conf.d folder). I think all that should work -- I haven't tested it. For security you might want to make sure you have setup a connector shared secret, see the CF10 Lockdown guide for instructions on setting that up. -- Pete Freitag Foundeo Inc. ColdFusion Consulting & Products (FuseGuard, HackMyCF) ... View more

The risk here is not just sending a lot of random form fields to the server - the server CAN typically handle thousands of form fields without performance issues. The DOS issue arrises when the form fields are named such that they all have the same hashcode (eg String.hashCode() equals the same value). This creates collisions in the underlying hashtable that is used to store the form scope -- these collisions are what makes the page REALLY slow to execute. For example on a quad core server sending ~60,000 form fields took over 30 minutes to execute. This setting is only server wide (because the issue can go up all the way to the servlet container, JRun or Tomcat) I wrote a blog entry on this which goes into some more detail: http://www.petefreitag.com/item/808.cfm -- Pete Freitag Foundeo Inc. makers of HackMyCF.com & FuseGuard ... View more

There is a bug report here for this issue, I suggest you vote it up: https://bugbase.adobe.com/index.cfm?event=bug&id=3540876 ... View more

IF you are doing the refresh to keep the session alive, then you probably want to do this client side using Javascript window.setInterval as you suggested or with the iframe meta-refresh as Dan suggested. Doing it with CF via a scheduled task will not preserve the session, unless you pass the session id's so you would need to create a lot of scheduled tasks, or use threads, either way it sounds like something you want to do client side. ... View more

You can't deploy an EAR file on tomcat alone, it is only a servlet container so you can only deploy WAR files -- you need to install a full J2EE server like JBoss to deploy EAR files.   Now it could be that the EAR file only contains a WAR file, and the WAR file could be extracted (these are just zip files with different extensions) and deployed by copying bits into the existing WEB-INF, but that may or may not work. ... View more

Are you running ColdFusion under a windows user account, if so make sure that you have given that account permission to write files to the path specified. ... View more

It will help, but it will probably not solve your problem. CF8 is an end of life product, so it does not have all possible security hotfixes available. The most critical omission for CF8 is the APSB13-03 patch which has been exploited quite a bit over the last 4-5 months.   Your best course of action is to ditch the server and do a fresh install of CF9 or 10 apply all security hotfixes and follow the lockdown guides for CF9 or CF10. -- Pete Freitag Foundeo Inc, makers of HackMyCF and FuseGuard ... View more

The VerifyClient functionality requires a special token be sent along with the ajax request, you will find that when you use CF's builtin ajax stuff it will send the client verification token for you automatically (eg cf ajax proxy). In your example you are using jquery to do the ajax call. -- Pete Freitag Foundeo Inc.  ... View more

Since this error is thrown from a Servlet not CFML the CFML error handlers won't work.  You would need to use the error handling capabilities of the Servlet engine, eg add a custom error-page tag to the web.xml file, see: http://livedocs.adobe.com/jrun/4/Programmers_Guide/techniques_servlet12.htm -- Pete Freitag Foundeo Inc. Makers of HackMyCF and FuseGuard ... View more

To help debug the issue you might want to also dump your cookie scope as well, do you have cookies disabled on IE for example? ... View more

Steve 9.0.2 is not an 'update', it is the same as CF 9.0.1 but without verity (and includes many hotfixes), because Adobe can no longer distribute verity that is the only version you can download now for CF9.  So there is no reason that you would need to uninstall CF9.0.1 and install 9.0.2 that I am aware of, just update your 9.0.1 install. ... View more

Just a hunch, but there is a new setting in CF10 (and was also added to CF9 via security hotfixes) which limits the number of form fields that can be posted. The default value for this setting is 100 form fields, if you have a lot of checkboxes or hidden fields you might hit this limit and need to increase it.   You can alter this setting in the ColdFusion 10 administrator Server Settings: Maximum number of POST request parameters. ... View more

The EOL for Java 6 was extended until the end of February by Oracle, which has also given Adobe some extra time to produce and test the update. ... View more

You can't simply upgrade the servlet filter api in JRun because JRun needs to actually implement the new servlet API methods.   Your options are: 1) to deploy to another servlet container (such as Tomcat, JBoss, etc) -- which requires a enterprise license 2) Figure something out at the web server level 3) Don't use J2EE sessions and use CF's sessions, then you can write the session cookies manually in onSessionStart (may not be an option if you need J2EE sessions) -- Pete Freitag http://hackmycf.com/ - ColdFusion Server Security Scanner http://fuseguard.com/ - Web App Firewall for ColdFusion ... View more

If you have the /CFIDE/h.cfm or  /CFIDE/i.cfm files they are not part of ColdFusion, and were placed there by an attacker. So you should delete them! You should probably do a fresh OS, CF install at this point, be sure to use new passwords for everything. There have been reports of files being added under the /CFIDE/adminapi directory as well in recent attacks, so you will want to look there as well (check file timestamps on all your files in CFIDE), but as I said consider doing a full reinstall. -- Pete Freitag HackMyCF.com - ColdFusion Server Security Scanner FuseGaurd.com - Web Application Firewall for ColdFusion ... View more

Those that have already applied the latest patch on CF9/10 but have been hacked, do you have a file /CFIDE/h.cfm /CFIDE/i.cfm or /CFIDE/help.cfm it is possible you had already been hit before applying the patch and still had a backdoor on your server. Note the file could be pretty much anywhere but under /CFIDE somewhere is a likley location. It is also possible that you have common third party software with a vulnerability that was hit, among many other things. It would be a good idea to review the web server logs around the time of the incident to see if you can uncover anything. If you find something that appears to be a new exploit you should send it to the Adobe Product Security Incident Response Team rather than posting it here: http://www.adobe.com/support/security/alertus.html In addition to applying patches you should also follow the ColdFusion Lockdown Guides: http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/91025512-cf9-lockdownguide-wp-ue.pdf http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/products/coldfusion-enterprise/pdf/CF10%20Lockdown%20Guide.pdf Pete Freitag, HackMyCF.com Foundeo Inc. ... View more

Paul,  Just another idea to consider for your photo storage, you could consider using Amazon S3, $10GB will cost you less than $1/month you can also reduce prices further if you pick reduced redundancy storage. Good chance to learn a new skill set, and then your photos will not be bound by what host you are on. There is more to the S3 pricing than just the storage cost but for light use it should not amount to more than a penny or two.   I would go the S3 route before trying the cfftp route, but hopefully you have already worked out a solution with Hostek. ... View more

A fresh install is probably your best bet, but you might also try installing the latest security hotfix because they include a copy of /CFIDE - I am not 100% sure that the cfide folder they include has everything in it though, but you could give it a try. When you copied from another version, are you sure you had all the same security hotfixes and cumulative hotfixes installed, if not then it would fail. ... View more

I don't know of anyone who has extended support for CF8, but I will try to find out if it is still available for purchase.  Depending on how many licenses you have it may be cheaper to just upgrade to 9 or 10. ... View more