Feeds

Adobe patches 'critical' flaws in ColdFusion, JRun

Code execution, information disclosure bugs dead

Remote control for virtualized desktops

Adobe Systems has released updates that patch vulnerabilities in two widely used web development applications, several of which let attackers steal sensitive data or take complete control of users' machines.

In all, the patches fix seven flaws in versions 8.0.1 and earlier of ColdFusion and JRun 4.0. The most serious of them are XSS, or cross-site scripting, bugs that allow attackers to execute malicious code on an underlying system by supplying a target with a booby-trapped web link.

Adobe engineers also fixed a separate management console flaw. It allowed unauthenticated users to traverse restricted directories, a vulnerability that could lead to information disclosure. Proof-of-concept code released Tuesday showed the flaw could be exploited using a URL that looks something like this:

http://[server]/server/[profile]/logging/logviewer.jsp?logfile=../../../../../../../boot.ini

The fixes come as Adobe, whose software is perhaps more ubiquitous than Microsoft's, struggles to patch a variety of security vulnerabilities that have been exploited to install malware on the machines running the programs. Three weeks ago, its security team pushed out a fix for a bug in its Flash Player that criminals were using to hijack user machines. Attackers last month were also able to compromise a large number of websites by targeting an open-source text editor bundled with ColdFusion.

In May, Adobe announced it was reinvigorating security measures used to design its Reader application used to view PDF documents. The initiative was a great start, but by no means adequate because it left Flash and other widely used Adobe titles out of the tent.

Adobe says here it is currently unaware of any exploits targeting the latest ColdFusion and JRun bugs. The company's security bulletin is available here. ®

Intelligent flash storage arrays

More from The Register

next story
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
Oi, Europe! Tell US feds to GTFO of our servers, say Microsoft and pals
By writing a really angry letter about how it's harming our cloud business, ta
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.