18 August 2009, 09:23
Adobe patches ColdFusion and JRun
Adobe has released patches for ColdFusion 7.02, 8.0, 8.0.1 and JRun 4.0 to prevent an attacker gaining unauthorised access to user accounts. The problem is caused by multiple cross-site scripting vulnerabilities.
Other patches fix a directory traversal vulnerability in the JRun Management Console which allowed arbitrary files to be retrieved from the server and a session fixation vulnerability in ColdFusion which could elevate privileges. Adobe classifies the errors as critical and recommends that the patches be installed as soon as possible.
See also:
- Security Update: Hotfixes available for ColdFusion and JRun, bulletin from Adobe
- Description of XSS Vulnerabilities, from Digital Research Group
(djwm)
Print Version | Send by email
| Permalink: http://h-online.com/-742993
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/6/7/2/comingin310_4_kicker-4977194bfb0de0d7.png)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/3/2/3/comingin310_3_kicker-151cd7b9e9660f05.png)
