Applying ColdFusion Security Patches Gotcha

A friend of mine has been having trouble getting a particular ColdFusion security hotfix applied APSB10-05. He follows the instructions in the KB article, however scans indicate the vulnerability exists.

As it turns out, this fix involved replacing some .jar files in the CF lib folder. The instructions state to make a backup of the files. In this case my friend simply copied them to the same folder. So flex-messaging.jar became copy-of- flex-messaging.jar. He then put up the two new .jar files and started back up the CF service.

The trouble is, those copies were still being loaded. CF loaded all the jar files in the folder, and presto bad jars were again loaded. Once he stopped the service, took the old jar files completely out of the CF install, then restarted everything passed inspection just fine.

A couple things to consider.

1) Just because you applied a hotfix doesn't mean it is applied correctly. 2) You should run scans to confirm. I recommend Hack My CF.