An important vulnerability (CVE-2010-2861) has been identified in ColdFusion 8.0, 8.0.1, 9.0, 9.0.1 for Windows, Macintosh and UNIX.

This technote provides a fix for the security issue along with the installation instructions.

A bit late to the party but Adobe released ColdFusion 9 update 1 (9.0.1) a few days ago. The top features in this release:

1. ORM support for multiple data sources in the same application
2. Amazon S3 support for both storing and consuming files in your ColdFusion applications
3. Support for IIS 7
4. New script functions implemented as CFCs
5. Support for BlazeDS 4 and LCDS 3
6. Configurable seed for password encryption
7. Server monitoring upgraded to run as a separate server to handle load conditions

In addition, there are some enhancements related to Language, Caching, Ajax, SpreadSheet, Solr, and Logging and scores of bug fixes.

Related Links:

1. FAQ
2. Release Notes

This guide describes how server administrators can improve the security of their ColdFusion server. Although the examples provided are for Microsoft Windows 2008 using Internet Information Services (IIS) 7 and Redhat Enterprise Linux (RHEL) 5.3 using Apache 2.2, many of the suggestions presented can be extrapolated to apply to similar operating systems and web servers.

You should test and validate all suggestions in this document on a nonproduction environment before deploying to production.

CF9 Released:

http://www.adobe.com/products/coldfusion/

CF9 Pricing:

http://www.adobe.com/products/coldfusion/buy/

CF9 EULA Changes:

http://www.terrenceryan.com/blog/post.cfm/coldfusion-9-eula-changes

ColdFusion Builder beta 2:

http://labs.adobe.com/technologies/coldfusionbuilder/

Adobe has released public beta of ColdFusion 9 (formerly Centaur) and ColdFusion Builder (formerly Bolt).

The ColdFusion 9 public beta release unveils three main themes: unrivaled developer productivity, deep enterprise integration and simple work flow with Adobe Flash Builder, Adobe AIR and AJAX to create expressive applications.

Adobe ColdFusion Builder is an Eclipse based IDE for ColdFusion development that is deeply integrated with ColdFusion 9. Now you can manage your entire ColdFusion development cycle from concept to production all in one easy to use tool.

ColdFusion 9 Documentation

These risks and warnings have been posted on many blogs already but here goes:

• Vulnerability with FCKEditor and how to fix it – The problem lies in the FCKEditor rich text editor, which is installed with ColdFusion 8
• MIME File Upload Security Issue and Tips for Secure File Uploads with ColdFusion

Update:

• Hotfix from Adobe to fix the FCKEditor Vulnerability