|
|
Home /
Groups /
ColdFusion Talk (CF-Talk)
cold fusion 5 0 cfrethrow exploit
> The root cause of the CFRETHROW exception is actually a Linux EGCSJeff Palmer 08/02/01 06:43 P
Author: Jeff Palmer
> The root cause of the CFRETHROW exception is actually a Linux EGCS > 1.1.2 C++ compiler object-code generation bug. This compiler is used to > build ColdFusion 4.5 and 5.0, and the bug is related to C++ exception > throwing and handling object code generation. This bug causes the internal > exception used to support the CFML CFRETHROW tag to exit the application > process, aborting the ColdFusion Server. There are many c/c++ compilers out their for the linux/(unix) environment. Is it possible that recompiling the source code with a different compiler would fix this vulnerability? Also, have you attempted to work with the EGCS team to fix this 'bug'? Further i would like to make one single comment about ColdFusion. You claim it's ColdFusion for linux, when in reality it's more "ColdFusion for RedHat" I have tried installing the ColdFusion server on various other flavors of linux, and none worked (granted I last tried with a ColdFusion beta, but I doubt much has changed. My comment is this. C/C++ is probably the most portable language in the world. With a little (probably VERY little) effort on allaires part, we could have a Coldfusion for *ix, which would be able run on most flavors of unix. (Redhat, slackware,debian,mandrake and other linux distros) as WELL as BSD (OpenBSD, FreeBSD, NetBSD, BSDi) If your marketing team did it's research, you'd probably see your sales would increase enough to make the code changes for cross platform binaries very profitable. Anyway.. the whole point to this email was lost.. Get with the EGCS developers and give them what you know about the bug.. maybe they can fix it.. also, try recompiling the codebase under another compiler and see if CFRETHROW is still vulnerable. Regards, Jeff Palmer scorpio@drkshdw.org ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Structure your ColdFusion code with Fusebox. Get the official book at http://www.fusionauthority. com/bkinfo.cfm
|
Mailing Lists
|
Latest Fusion Authority Articles
|
||||||
