Allaire ColdFusion 4.5.1 Cached File Request DoS Vulnerability

It is possible to remotely halt the operation of Allaire ColdFusion Server by requesting a cached file that is no longer stored in memory and contains a <CFCACHE> tag. Other conditions that are necessary in order to reliably cause a denial of service in this instance are that there are no running thread request slots available at the time of the cached file request, knowledge of the timeout period, last cached date/time, and 'Limit Simultaneous Requests' setting (which is by default, 5), and the use of a load generator or DoS tool. Most of these requirements can be met by performing various reconnaissance actions against the server, or ignored by making relatively safe assumptions, taking into account the default settings and the traffic levels/popularity of the server.

The default number of cached file requests that ColdFusion Server can handle is 5. Therefore, 6 simultaneous requests for the same cached file no longer in memory could possibly cause the server to stop responding and will require to be restarted in order to regain normal functionality.


Privacy Statement
Copyright 2010, SecurityFocus