Just last week, Adobe released their security updates (APSB17-30) for ColdFusion 2016 and ColdFusion 11. The said update was specifically created to fix two critical and one important issue. However, take note that the ColdFusion 10 and older will be vulnerable to some if not all of the issues. Plus, since the older versions began to become obsolete, there won't be any additional patches provided.
Adobe also stated that the fixes will be effective only when running the Java 1.8 update 121 or higher (Java 1.7 update 131 or higher but Java 7 is also EOL, which means you need to be running 1.8 if you use CF11+).
Because of the vulnerability of CVE-2017-11286, it is categorized as Improper Restriction of XML External Entity Reference. This can trigger the possibility of XML External Injection that will allow attackers to have access to resources via commands to the XML parser.
The second vulnerability of CVE-2017-11283 and CVE-2017-11284 is that Adobe described it as an “unsafe Java deserialization that could result in remote code execution”. Until now it is unclear if that would affect the use of the serialize() / deserialize () functions or if it will have broader issues.
And to continue learning how to make your ColdFusion apps more modern and alive, I encourage you to download our free ColdFusion Alive Best Practices Checklist.
Because… perhaps you are responsible for a mission-critical or revenue-generating CF application that you don’t trust 100%, where implementing new features is a painful ad-hoc process with slow turnaround even for simple requests.
What if you have no contingency plan for a sudden developer departure or a server outage? Perhaps every time a new freelancer works on your site, something breaks. Or your application availability, security, and reliability are poor.
And if you are depending on ColdFusion for your job, then you can’t afford to let your CF development methods die on the vine.
You’re making a high-stakes bet that everything is going to be OK using the same old app creation ways in that one language — forever.
All it would take is for your fellow CF developer to quit or for your CIO to decide to leave the (falsely) perceived sinking ship of CFML and you could lose everything—your project, your hard-won CF skills, and possibly even your job.
Luckily, there are a number of simple, logical steps you can take now to protect yourself from these obvious risks.
No Brainer ColdFusion Best Practices to Ensure You Thrive No Matter What Happens Next
ColdFusion Alive Best Practices Checklist
Modern ColdFusion development best practices that reduce stress, inefficiency, project lifecycle costs while simultaneously increasing project velocity and innovation.
√ Easily create a consistent server architecture across development, testing, and production
√ A modern test environment to prevent bugs from spreading
√ Automated continuous integration tools that work well with CF
√ A portable development environment baked into your codebase… for free!
Learn about these and many more strategies in our free ColdFusion Alive Best Practices Checklist.
