| CVE-2008-1203 |
|
发布时间 :2008-03-11 20:44:00 | ||
| 修订时间 :2011-03-07 22:06:19 | ||||
| NMCOS |
[原文]The administrator interface for Adobe ColdFusion 8 and ColdFusion MX7 does not log failed authentication attempts, which makes it easier for remote attackers to conduct brute force attacks without detection.
[CNNVD]Adobe ColdFusion 管理界面暴力猜测攻击漏洞(CNNVD-200803-182)
ColdFusion MX是一款高效的网络应用服务器开发环境，具有很高的易用性和开发效率，基于标准的Java技术，可以与XML、Web Services和Microsoft.NET环境相集成。
ColdFusion没有记录到管理界面失败的登录尝试，这可能便于攻击者执行暴力猜测攻击。
–
CVSS (基础分值)
| CVSS分值: | 7.5 | [严重(HIGH)] |
| 机密性影响: | PARTIAL | [很可能造成信息泄露] |
| 完整性影响: | PARTIAL | [可能会导致系统文件被修改] |
| 可用性影响: | PARTIAL | [可能会导致性能下降或中断资源访问] |
| 攻击复杂度: | LOW | [漏洞利用没有访问限制 ] |
| 攻击向量: | NETWORK | [攻击者不需要获取内网访问权或本地访问权] |
| 身份认证: | NONE | [漏洞利用无需身份认证] |
–
CPE (受影响的平台与产品)
| cpe:/a:adobe:coldfusion:8.0 | Adobe ColdFusion 8.0 |
| cpe:/a:adobe:coldfusion:7.0 | Adobe ColdFusion MX 7.0 |
–
OVAL (用于检测的技术细节)
| 未找到相关OVAL定义 |
–
官方数据库链接
–
其它链接及资源
|
http://www.securityfocus.com/bid/28207 (PATCH) BID 28207 |
|
http://www.adobe.com/support/security/bulletins/apsb08-08.html (PATCH) CONFIRM http://www.adobe.com/support/security/bulletins/apsb08-08.html |
|
http://www.vupen.com/english/advisories/2008/0862/references (UNKNOWN) VUPEN ADV-2008-0862 |
|
http://xforce.iss.net/xforce/xfdb/41150 (UNKNOWN) XF coldfusion-interface-brute-force(41150) |
|
http://www.securitytracker.com/id?1019600 (UNKNOWN) SECTRACK 1019600 |
|
http://secunia.com/advisories/29332 (UNKNOWN) SECUNIA 29332 |
–
漏洞信息
| Adobe ColdFusion 管理界面暴力猜测攻击漏洞 | |
| 高危 | 设计错误 |
| 2008-03-11 00:00:00 | 2008-09-05 00:00:00 |
| 远程 | |
| ColdFusion MX是一款高效的网络应用服务器开发环境，具有很高的易用性和开发效率，基于标准的Java技术，可以与XML、Web Services和Microsoft.NET环境相集成。 ColdFusion没有记录到管理界面失败的登录尝试，这可能便于攻击者执行暴力猜测攻击。 |
|
–
公告与补丁
–
漏洞信息
42997 |
|
| Adobe ColdFusion Admin Interface Failed Login Logging Weakness | |
| Loss of Integrity | Patch / RCS |
| Vendor Verified | |
–
漏洞描述
–
时间线
2008-03-11 |
Unknow |
| Unknow | Unknow |
–
解决方案
| Currently, there are no known workarounds or upgrades to correct this issue. However, Adobe has released a patch to address this vulnerability. |
–
相关参考
–
漏洞作者
| Unknown or Incomplete |
–
漏洞信息
| Adobe ColdFusion Administration Interface Failed Login Audit Vulnerability | |
Design Error |
28207 |
| Yes | No |
| 2008-03-11 12:00:00 | 2008-03-12 09:01:00 |
This issue was disclosed by the vendor. |
|
–
受影响的程序版本
| Adobe ColdFusion MX 7.00 Adobe ColdFusion 8.0 |
–
漏洞讨论
| Adobe ColdFusion is prone to a vulnerability that allows attackers to conceal login attempts to the administrative interface. Attackers can exploit this issue to hide or obfuscate actual attack traces. This issue affects ColdFusion MX 7 and ColdFusion 8. |
–
漏洞利用
|
An attacker can exploit this issue with a browser.
|
–
解决方案
|
The vendor released an advisory and updates to address this issue. Please see the references for more information. Adobe ColdFusion 8.0
|
![[单曲] 有你有我,所谓痛苦不算什么！-微慑信息网-VulSee.com](http://images.blogcn.com/2006/11/5/7/shanxiacao,20061105131527.gif)
![[美图] 最美自拍女教师裸照惊现[真实7P]-微慑信息网-VulSee.com](http://www.enoya.com/1139444703/Day_081114/24_169364_02599784e687a7d.jpg)
![[八卦] 王婷婷—揭秘一个大三女生的性爱录像-微慑信息网-VulSee.com](http://free.86hy.com/crack/pic/1.jpg)
![[随笔]今天国际警察节-微慑信息网-VulSee.com](http://photo.sohu.com/20041017/Img222528326.jpg)
青云网
