Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.1084
Multiple vulnerabilities have been identified in Adobe ColdFusion
11 April 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Adobe ColdFusion
Publisher: Adobe
Operating System: Windows
UNIX variants (UNIX, Linux, OSX)
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Increased Privileges -- Existing Account
Cross-site Scripting -- Remote with User Interaction
Access Confidential Data -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2018-4942 CVE-2018-4941 CVE-2018-4940
CVE-2018-4939 CVE-2018-4938
Original Bulletin:
https://helpx.adobe.com/security/products/coldfusion/apsb18-14.html
- --------------------------BEGIN INCLUDED TEXT--------------------
Adobe Security Bulletin
Applies to: ColdFusion
Last Published: April 11, 2018
Security updates available for ColdFusion | APSB18-14
+-------------------------+--------------------------------+------------------+
|Bulletin ID |Date Published |Priority |
+-------------------------+--------------------------------+------------------+
|APSB18-14 |April 10, 2018 |2 |
+-------------------------+--------------------------------+------------------+
Summary
Adobe has released security updates for ColdFusion version 11 and the 2016
release. These updates resolve an important insecure library loading
vulnerability (CVE-2018-4938), an important cross-site scripting vulnerability
that could lead to code injection (CVE-2018-4940) and an important cross-site
scripting vulnerability that could lead to information disclosure
(CVE-2018-4941). These updates also include a mitigation for a critical unsafe
Java deserialization vulnerability (CVE-2018-4939) and a mitigation for a
critical unsafe XML parsing vulnerability (CVE-2018-4942).
Affected Versions
+----------------------+----------------------+----------------------+
| Product | Affected Versions | Platform |
+----------------------+----------------------+----------------------+
|ColdFusion (2016 |Update 5 and earlier |All |
|release) |versions | |
+----------------------+----------------------+----------------------+
|ColdFusion 11 |Update 13 and |All |
| |earlier versions | |
+----------------------+----------------------+----------------------+
Solution
Adobe categorizes this update with the following priority rating and recommends
users update their installations to the newest versions:
+------------------------+--------------+--------+--------------+------------+
| Product | Updated |Platform| Priority |Availability|
| | Version | | rating | |
+------------------------+--------------+--------+--------------+------------+
|ColdFusion (2016 |Update 6 |All |2 |Tech note |
|release) | | | | |
+------------------------+--------------+--------+--------------+------------+
|ColdFusion 11 |Update 14 |All |2 |Tech note |
+------------------------+--------------+--------+--------------+------------+
Note:
The security updates referenced in the above Tech Notes require JDK 8u121 or
higher (for ColdFusion 2016) and JDK 7u131 or JDK 8u121 (for ColdFusion 11).
Adobe recommends updating your ColdFusion JDK/JRE to the latest version.
Applying the ColdFusion update without a corresponding JDK update will NOT
secure the server. See the relevant Tech Notes for more details.
Customers should also apply the security configuration settings as outlined on
the ColdFusion Security page as well as review the respective Lockdown guides.
o ColdFusion (2016 release) Lockdown Guide
o ColdFusion 11 Lockdown Guide
Vulnerability Details
+-------------------------+------------------+---------+----------------------+
| Vulnerability Category | Vulnerability |Severity | CVE Numbers |
| | Impact | | |
+-------------------------+------------------+---------+----------------------+
|Insecure Library Loading |Local privilege |Important|CVE-2018-4938 |
| |escalation | | |
+-------------------------+------------------+---------+----------------------+
|Deserialization of |Remote code |Critical |CVE-2018-4939 |
|Untrusted Data |execution | | |
+-------------------------+------------------+---------+----------------------+
|Cross-Site Scripting |Information |Important|CVE-2018-4940 |
| |Disclosure | | |
+-------------------------+------------------+---------+----------------------+
|Cross-Site Scripting |Information |Important|CVE-2018-4941 |
| |Disclosure | | |
+-------------------------+------------------+---------+----------------------+
|Unsafe XML External |Information |Critical |CVE-2018-4942 |
|Entity Processing |Disclosure | | |
+-------------------------+------------------+---------+----------------------+
Acknowledgements
Adobe would like to thank the following individuals and organizations for
reporting these issues and for working with Adobe to help protect our
customers:
o Nitesh Shilpkar (CVE-2018-4938)
o Nick Bloor of NCC Group (CVE-2018-4939)
o Jaaziel Sam Carlos (CVE-2018-4940)
o William Eatman and Michael S. O'Dell from USRA (CVE-2018-4941)
o Matthias Kaiser of Code White GmbH (CVE-2018-4942)
ColdFusion JDK Requirement
COLDFUSION 2016 HF6
This security update requires ColdFusion to be on JDK 8u121 or higher. Adobe
recommends updating your ColdFusion JDK/JRE to the latest version. Applying the
ColdFusion update without a corresponding JDK update will NOT secure the
server.
For Application Servers
Additionally, on JEE installations, set the following JVM flag,
"-Djdk.serialFilter= !org.mozilla.**;!com.sun.syndication.**", in the
respective startup file depending on the type of Application Server being used.
For example:
On Apache Tomcat Application Server, edit JAVA_OPTS in the 'Catalina.bat/sh'
file
On WebLogic Application Server, edit JAVA_OPTIONS in the 'startWeblogic.cmd'
file
On a WildFly/EAP Application Server, edit JAVA_OPTS in the 'standalone.conf'
file
Set the JVM flags on a JEE installation of ColdFusion, not on a standalone
installation.
COLDFUSION 11 HF14
This security update requires ColdFusion to be on JDK 7u131 or JDK 8u121 or
higher.
Adobe recommends updating your ColdFusion JDK/JRE to the latest version.
Applying the ColdFusion update without a corresponding JDK update will NOT
secure the server.
For Application Servers
Additionally, on J2EE installations, set the following JVM flag,
"-Djdk.serialFilter= !org.mozilla.**;!com.sun.syndication.**", in the
respective startup file depending on the type of Application Server being used.
For example:
On Apache Tomcat Application Server, edit JAVA_OPTS in the 'Catalina.bat/sh'
file
On WebLogic Application Server, edit JAVA_OPTIONS in the 'startWeblogic.cmd'
file
On a WildFly/EAP Application Server, edit JAVA_OPTS in the 'standalone.conf'
file
Set the JVM flags on a JEE installation of ColdFusion, not on a standalone
installation.
Adobe Disclaimer
License agreement
By using software of Adobe Systems Incorporated or its subsidiaries ("Adobe");
you agree to the following terms and conditions. If you do not agree with such
terms and conditions; do not use the software. The terms of an end user license
agreement accompanying a particular software file upon installation or download
of the software shall supersede the terms presented below.
The export and re-export of Adobe software products are controlled by the
United States Export Administration Regulations and such software may not be
exported or re-exported to Cuba; Iran; Iraq; Libya; North Korea; Sudan; or
Syria or any country to which the United States embargoes goods. In addition;
Adobe software may not be distributed to persons on the Table of Denial Orders;
the Entity List; or the List of Specially Designated Nationals.
By downloading or using an Adobe software product you are certifying that you
are not a national of Cuba; Iran; Iraq; Libya; North Korea; Sudan; or Syria or
any country to which the United States embargoes goods and that you are not a
person on the Table of Denial Orders; the Entity List; or the List of Specially
Designated Nationals. If the software is designed for use with an application
software product (the "Host Application") published by Adobe; Adobe grants you
a non-exclusive license to use such software with the Host Application only;
provided you possess a valid license from Adobe for the Host Application.
Except as set forth below; such software is licensed to you subject to the
terms and conditions of the End User License Agreement from Adobe governing
your use of the Host Application.
DISCLAIMER OF WARRANTIES: YOU AGREE THAT ADOBE HAS MADE NO EXPRESS WARRANTIES
TO YOU REGARDING THE SOFTWARE AND THAT THE SOFTWARE IS BEING PROVIDED TO YOU
"AS IS" WITHOUT WARRANTY OF ANY KIND. ADOBE DISCLAIMS ALL WARRANTIES WITH
REGARD TO THE SOFTWARE; EXPRESS OR IMPLIED; INCLUDING; WITHOUT LIMITATION; ANY
IMPLIED WARRANTIES OF FITNESS FOR A PARTICULAR PURPOSE; MERCHANTABILITY;
MERCHANTABLE QUALITY OR NONINFRINGEMENT OF THIRD PARTY RIGHTS. Some states or
jurisdictions do not allow the exclusion of implied warranties; so the above
limitations may not apply to you.
LIMIT OF LIABILITY: IN NO EVENT WILL ADOBE BE LIABLE TO YOU FOR ANY LOSS OF
USE; INTERRUPTION OF BUSINESS; OR ANY DIRECT; INDIRECT; SPECIAL; INCIDENTAL; OR
CONSEQUENTIAL DAMAGES OF ANY KIND (INCLUDING LOST PROFITS) REGARDLESS OF THE
FORM OF ACTION WHETHER IN CONTRACT; TORT (INCLUDING NEGLIGENCE); STRICT PRODUCT
LIABILITY OR OTHERWISE; EVEN IF ADOBE HAS BEEN ADVISED OF THE POSSIBILITY OF
SUCH DAMAGES. Some states or jurisdictions do not allow the exclusion or
limitation of incidental or consequential damages; so the above limitation or
exclusion may not apply to you.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWs1b0Yx+lLeg9Ub1AQiDAhAAk2+vmO3DDCBy6XXP8DRF2UudUsdJttd9
RO9efFN5tLU6rv9XEClai9xxB+dQ2pYnF//V670X3Tvfe7csuRpLK1SBEdayUBQd
QUQycyZYt4Au1d8FYikr9t/XE7GkA3HD8wVERrqRmTKq7hKJqCl+I+kAbD0NGUvs
vzOQNFE5kdqSs8TMLZ8LhdkV0seYqzMhqSBiGuF22ryfu0OquJXnEKxlk03tLrOX
B94Ke3Eb9bZ0w/N5KUVgcPALySakLMxHUQfPl0ERsZ1Lzr5RaP4NHOjEGlK4ezDk
Uh+yVM7ALZz3E05Kh6L4Azyj0qsdNiaCr6xqHZoUgCUolN+5JTAf69FZ4KlW+hTc
igg2sHXxt3T7DT8wnleAHfHxvSEmQ7Mv1SfQaD0XCAjg/wHCeR+BJPRNswGQyyAq
GkVjR8yVAvA+FoloKuM9Lk+4JFF7aqlayQAjY6na60Cm1cyy65Vzw4pIl9xVapOy
kBFvJzLKxYCI7/I5S2Djz4YEg47KgOLjIEWr9ngUE0pub5XqQGVF8Bx6Us8+evUG
qeslJqSC/WGep+yZjKHZ7h8O7TkKYROvAn0vLMMnPg2EoYzgLlIZuLAQZozZ52sd
IlInv0EI5q8T9clTYyZU+WrlQnCsVL3OMTkqXbLMtzgK1TkAfFyNOuKTymdtQClc
u+nCieKdUFc=
=g2n4
-----END PGP SIGNATURE-----