Patch Available for CFCACHE Tag Potential Exploit

Released: January 4, 2000

This bug concerns ColdFusion 4.0x users.

Problem: The CFCACHE tag, which performs template caching to increase page delivery performance, creates several temporary files, including one that contains absolute filenames with directory path information, URL parameters and timestamps. In ColdFusion 4.0x, these files are stored in the same directory as the .CFM page, usually in a publicly accessible web document directory, making information about the web document directory structure or URL parameters used to call site pages accessible.

Solution: Allaire has released a new version of the CFCACHE tag (also available in ColdFusion 4.5) that allows users to specify a non-web document directory to store the temporary file, making them inaccessible to browsers.

For more information, see Allaire Security Bulletin (ASB00-03)

• Subscribe
• RSS

• Editorial
• Specials
• Community
• News
• Tech and Tags
• Views
• Reviews
• Techniques
• Security
• Best of ColdFusion Talk
• Knowledge Base
• Blog Watch

• Tipical Charlie