====================================================================

                                CERT-Renater

                      Note d'Information No. 2012/VULN123
____________________________________________________________________

DATE                : 14/03/2012

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S) : Systems running running
                       Adobe ColdFusion versions 9.0.1, 9.0, 8.0.1, 8.0.

======================================================================
http://www.adobe.com/support/security/bulletins/apsb12-06.html
_______________________________________________________________________

Security update: Hotfix available for ColdFusion

Release date: March 13, 2012

   Vulnerability identifier: APSB12-06

   Priority: 2

   CVE number: CVE-2012-0770

   Platform: All Platforms

Summary

   This priority 2 update addresses an important vulnerability in
   ColdFusion 9.0.1 and earlier versions for Windows, Macintosh and UNIX.
   This vulnerability could lead to a denial of service attack using a
   hash algorithm collision. Adobe recommends users update their product
   installation using the instructions provided in the "Solution" section
   below.

Affected software versions

   ColdFusion 9.0.1, 9.0, 8.0.1 and 8.0 for Windows, Macintosh and UNIX

Solution

   Adobe recommends affected ColdFusion customers update their
   installation using the instructions provided in the technote:
   http://helpx.adobe.com/coldfusion/kb/coldfusion-security-hotfix.html.

Priority and Severity ratings

   Adobe categorizes these updates with the following priority and
   severity ratings, and recommends users update their installations to
   the newest versions:
   Priority: 2
   Severity: Important

Details

   This priority 2 update addresses an important vulnerability in
   ColdFusion 9.0.1 and earlier versions for Windows, Macintosh and UNIX.
   This vulnerability could lead to a denial of service attack using a
   hash algorithm collision. Adobe has provided a solution to address the
   reported vulnerability. It is recommended that users update their
   product installation using the instructions provided in the "Solution"
   section above.

   This update resolves a denial of service attack using a hash algorithm
   collision (CVE-2012-0770).

Adobe Disclaimer

License agreement

   By using software of Adobe Systems Incorporated or its subsidiaries
   ("Adobe"); you agree to the following terms and conditions. If you do
   not agree with such terms and conditions; do not use the software. The
   terms of an end user license agreement accompanying a particular
   software file upon installation or download of the software shall
   supersede the terms presented below.

   The export and re-export of Adobe software products are controlled by
   the United States Export Administration Regulations and such software
   may not be exported or re-exported to Cuba; Iran; Iraq; Libya; North
   Korea; Sudan; or Syria or any country to which the United States
   embargoes goods. In addition; Adobe software may not be distributed to
   persons on the Table of Denial Orders; the Entity List; or the List of
   Specially Designated Nationals.

   By downloading or using an Adobe software product you are certifying
   that you are not a national of Cuba; Iran; Iraq; Libya; North Korea;
   Sudan; or Syria or any country to which the United States embargoes
   goods and that you are not a person on the Table of Denial Orders; the
   Entity List; or the List of Specially Designated Nationals. If the
   software is designed for use with an application software product (the
   "Host Application") published by Adobe; Adobe grants you a
   non-exclusive license to use such software with the Host Application
   only; provided you possess a valid license from Adobe for the Host
   Application. Except as set forth below; such software is licensed to
   you subject to the terms and conditions of the End User License
   Agreement from Adobe governing your use of the Host Application.

   DISCLAIMER OF WARRANTIES: YOU AGREE THAT ADOBE HAS MADE NO EXPRESS
   WARRANTIES TO YOU REGARDING THE SOFTWARE AND THAT THE SOFTWARE IS BEING
   PROVIDED TO YOU "AS IS" WITHOUT WARRANTY OF ANY KIND. ADOBE DISCLAIMS
   ALL WARRANTIES WITH REGARD TO THE SOFTWARE; EXPRESS OR IMPLIED;
   INCLUDING; WITHOUT LIMITATION; ANY IMPLIED WARRANTIES OF FITNESS FOR A
   PARTICULAR PURPOSE; MERCHANTABILITY; MERCHANTABLE QUALITY OR
   NONINFRINGEMENT OF THIRD PARTY RIGHTS. Some states or jurisdictions do
   not allow the exclusion of implied warranties; so the above limitations
   may not apply to you.

   LIMIT OF LIABILITY: IN NO EVENT WILL ADOBE BE LIABLE TO YOU FOR ANY
   LOSS OF USE; INTERRUPTION OF BUSINESS; OR ANY DIRECT; INDIRECT;
   SPECIAL; INCIDENTAL; OR CONSEQUENTIAL DAMAGES OF ANY KIND (INCLUDING
   LOST PROFITS) REGARDLESS OF THE FORM OF ACTION WHETHER IN CONTRACT;
   TORT (INCLUDING NEGLIGENCE); STRICT PRODUCT LIABILITY OR OTHERWISE;
   EVEN IF ADOBE HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Some
   states or jurisdictions do not allow the exclusion or limitation of
   incidental or consequential damages; so the above limitation or
   exclusion may not apply to you.


======================================================================

=========================================================
Les serveurs de référence du CERT-Renater
http://www.cru.fr/securite
http://www.renater.fr
=========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44          +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
+ 75013 Paris           | email: certsvp@renater.fr     +
=========================================================