# MA-364.112013: MyCERT Alert - Security Updates

**Date:** 14 Nov 2013  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-364.112013  
**Advisory ID:** MA-364.112013

---

**1.0 Introduction**
Adobe has released a security hotfix for ColdFusion versions 10, 9.0.2, 9.0.1 and 9.0 for Windows, Macintosh and Linux.  Adobe recommends users update their product installation to the newest version.
**2.0 Impact**
This hotfix addresses a reflected cross site scripting vulnerability (CVE-2013-5326) that could be exploited by a remote, authenticated user on ColdFusion 10 and earlier when the CFIDE directory is exposed.
**3.0 Affected Products**
ColdFusion 10, 9.0.2, 9.0.1 and 9.0 for Windows, Macintosh and Linux
**4.0 Recommendation**
MyCERT recommends users update their software installations by following the instructions below.
Adobe recommends ColdFusion customers update their installation using the instructions provided in the technote located here:
- <http://helpx.adobe.com/coldfusion/kb/coldfusion-security-hotfix-apsb13-27.html>
Customers should also apply the security configuration settings as outlined on the ColdFusion Security page as well as review the ColdFusion 9 Lockdown Guide and ColdFusion 10 Lockdown Guide.
> ColdFusion Security Page:
> <http://help.adobe.com/en_US/ColdFusion/10.0/Admin/WSc3ff6d0ea77859461172e0811cbf364104-7ff2.html>
>
> ColdFusion 9 Lockdown Guide
> <http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/91025512-cf9-lockdownguide-wp-ue.pdf>
>
> ColdFusion 10 Lockdown Guide
> <http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/products/coldfusion-enterprise/pdf/cf10-lockdown-guide.pdf>
MyCERT generally advise users to keep themselves updated with the latest security announcements by the vendor. For further assistance, please reach us through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#701d0913150204301d09131502045e1f02175e1d09)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0 References**
- <http://www.adobe.com/support/security/bulletins/apsb13-27.html>