Allaire's Response to ColdFusion Server 4.5.1 DoS Vulnerability

 
May 15, 2000
The following response from Allaire on the apparent ColdFusion Server 4.5.1 DoS Vulnerability brought to light by Ryan Hill this month was received on the secure@allaire.com mailing list:

"In Response to Ryan Hill's 'ColdFusion Server 4.5.1 DoS Vulnerability.' Exploit Announcement:

"We tested denial of service scenarios with various ColdFusion Administrator settings that we believed were relevant to Mr. Hill's Exploit Announcement issue. Our test results indicated that such an attack attempt must originate from an individual possessing insider site information using denial of service attack techniques, and therefore represents the threat level of a conventional denial of service attack against any site.

"Below are what we believe an attacker would need to perpetrate a successful attack involving the use of <CFCACHE>:

  1. Knowledge of which ColdFusion template(s) on the target server use the <CFCACHE> tag.
  2. Knowledge of the exact timeout period coded in the ColdFusion template(s) on the target server using the <CFCACHE> tag.
  3. Knowledge of the exact last cached date/time of the ColdFusion template(s) on the target server using the <CFCACHE> tag (i.e.. which template(s) that use the <CFCACHE> tag have had cached copies removed from the template's CACHEDDIRECTORY or have never been cached by the server).
  4. Knowledge of ColdFusion Administrator Settings: 'Limit Simultaneous Requests' setting
  5. Knowledge that the 'Timeout requests after XX seconds' setting in the ColdFusion Administrator is OFF (or that 'Timeout requests after XX seconds' is set to a very high number of seconds).
  6. Use of a load testing or other load-generation or denial-of-service tool to actually request the template in question exactly simultaneously with more connections than the ColdFusion Administrator setting for 'Limit Simultaneous Requests'. Tests could not cause a successful attack manually using Internet browsers; an automated load testing tool had to be used.

    "Using exactly the same number of full-speed load test robots as the ColdFusion Administrator setting for 'Limit Simultaneous Requests' creates a stress condition the server will recover normally from. Using a large number of load test robots could cause the deadlock condition if all of the above information is known, conditions are right and all settings are set as described, but our testing indicates a substantially higher number of automated test robots would be required than the number of Simultaneous Requests set in the ColdFusion Administrator. Additionally, the attack could not be initiated via a regular Internet browser issuing repeated identical requests.

    "To further reduce the chance of successful attacker reconnaissance in attempting such an attack, Allaire released Allaire Security Bulletin (ASB00-03): Patch Available For Potential Information Exposure By The CFCACHE Tag (URL: http://www.allaire.com/handlers/index.cfm?ID=13978&Method=Full ) on January 4, 2000. The Bulletin recommends ColdFusion customers use this patch to relocate temporary cache files to a secure, non-web browser accessible document directory. Without the information available from a system where the patch and bulletin recommendations have _not_ been implemented, the proposed exploit _must_ run a typical denial of service attack in order to locate a ColdFusion template that uses the <CFCACHE> tag.

    "The knowledge that Mr. Hill's exploit assumes is only available when users have not implemented the patch or recommendations printed in ASB00-03.

    "In summary, the amount of site administrative and developer information coupled with the demanding requirements to successfully launch such an attack must originate from an individual possessing insider site information using denial of service attack techniques and tools, and approximates the same threat level as a conventional denial of service attack against virtually any site."

    Malcolm Gin
    Security Response Team Coordinator

    So I guess the moral of the story is, know the people you hire!

    7. Privacy | FAQ | Site Map | About | Guidelines | Contact | Advertising | What is ColdFusion?
    House of Fusion | ColdFusion Jobs | Blog of Fusion | AHP Hosting