# MA-349.052013: MyCERT Alert - Critical Vulnerability in Adobe ColdFusion

**Date:** 10 May 2013  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-349.052013  
**Advisory ID:** MA-349.052013

---

**1.0 Introduction**
Adobe has identified a critical vulnerability affecting Adobe ColdFusion 10, 9.0.2, 9.0.1 and 9.0 and earlier versions for Windows, Macintosh and UNIX. This vulnerability  could permit an unauthorized user to remotely retrieve files stored on the server.
**2.0 Impact**
The vulnerability may allow an unauthorized user to remotely retrieve files stored on the server.
**3.0 Affected Products**
The below versions of ColdFusion and earlier for Windows, Macintosh and Unix are affected:
- ColdFusion 10
- ColdFusion 9.0.2
- ColdFusion 9,0,1
- ColdFusion 9.0
**4.0 Recommendation**
Adobe is in the process of finalizing a fix for this issue and expect a hotfix for ColdFusion 10, 9.0.2, 9.0.1 and 9.0 for Windows, Macintosh and UNIX to be available on May 14, 2013.
Adobe recommends ColdFusion customers take the below workaround steps to mitigate this vulnerability.
- Restrict public access to the CFIDE/administrator, CFIDE/adminapi and CFIDE/gettingstarted\* directories by following the hardening guidance in the ColdFusion 9 Lockdown Guide and ColdFusion 10 Lockdown Guide
- Refer to the ColdFusion 9 Lockdown Guide and ColdFusion 10 Lockdown Guide for security best practices and further information on these hardening techniques.
MyCERT advise users must keep themselves updated with the latest security announcements by the vendor for the fix to correct the vulnerability.
MyCERT can be reached for assistance at:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#d1bca8b2b4a3a591bca8b2b4a3a5ffbea3b6ffbca8) or [[email protected]](/cdn-cgi/l/email-protection#1d7e647f786f2424245d7e647f786f6e787e686f746964337064)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: <https://www.mycert.org.my>
**5.0 References**
- <http://auscert.org.au/17516>
- <http://www.us-cert.gov/ncas/current-activity/2013/05/09/Adobe-Releases-Security-Advisory-ColdFusion>
- <https://www.us-cert.gov/ncas/alerts/TA13-107A>