AusCERT - ESB-2005.0992 -- [Win][UNIX/Linux] -- Multiple vulnerabilities in Adobe (Macromedia) products

HOME
About AusCERT
Membership
PKI Services
Training
Publications
Sec. Bulletins
Conferences
News & Media
Services
Web Log
Site Map
Site Help
Member login
ESB-2005.0992 -- [Win][UNIX/Linux] -- Multiple vulnerabilities in Adobe (Macromedia) products
Date: 16 December 2005

Click here for printable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                    ESB-2005.0992 -- [Win][UNIX/Linux]
          Multiple vulnerabilities in Adobe (Macromedia) products
                             16 December 2005

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Flash Media Server
                   ColdFusion MX 6.x
                   JRun 4.0 server
                   ColdFusion MX 7
Publisher:         Adobe
Operating System:  Windows
                   UNIX variants (UNIX, Linux, OSX)
Impact:            Administrator Compromise
                   Inappropriate Access
                   Denial of Service
                   Reduced Security
Access:            Remote/Unauthenticated

Original Bulletin: http://www.macromedia.com/go/mpsb05-11
                   http://www.macromedia.com/go/mpsb05-12
                   http://www.macromedia.com/go/mpsb05-13
                   http://www.macromedia.com/go/mpsb05-14

- --------------------------BEGIN INCLUDED TEXT--------------------


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
Adobe Security Bulletins: 

- - Flash Media Server 
- - ColdFusion MX 6.X 
- - JRun 4.0 server 
- - ColdFusion MX 7  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 

MPSB05-11  Administrator Interface Denial of Service 
Vulnerability in Flash Media Server 

Originally posted: December 15, 2005

Summary: 
This bulletin addresses a publicly reported security issue 
with Flash Media Server.

Affected Software Versions: 
* Flash Media Server 2.0
* Flash Media Server 1.5

Severity Rating: 
Adobe categorizes this issue as important and recommends 
users apply this workaround to their installations:  
http://www.macromedia.com/go/mpsb05-11 

Learn more: 
http://www.macromedia.com/go/mpsb05-11 

~~~~~~~ 

MPSB05-12 Sandbox Security and CFMAIL Vulnerability in 
ColdFusion MX 6.X 

Originally posted: December 15, 2005

Summary: 
This bulletin addresses two (2) privately reported security 
issues with ColdFusion 6.X. 

Affected Software Versions: 
ColdFusion MX 6.0 
ColdFusion MX 6.1 
ColdFusion MX 6.1 with JRun 

Severity Rating: 
Adobe categorizes this issue as a important issue and 
recommends users patch their installations.

Learn more: 
http://www.macromedia.com/go/mpsb05-12 

~~~~~~~ 

MPSB05-13 Cumulative Security Updater for JRun 4.0 
server 

Originally posted: December 15, 2005

Summary: 
This is a cumulative security updater for JRun server 
that includes all previously released patches for 4.0. 

Affected Software Versions:  
JRun 4.0 (all editions) 

Severity Rating: 
Adobe categorizes this issue as a important issue 
and recommends users patch their installations.

Learn more: 
http://www.macromedia.com/go/mpsb05-13 

~~~~~~~ 

MPSB05-14 Cumulative Security Updater for ColdFusion MX 7 

Originally posted: December 15, 2005

Summary:  
This is a cumulative security updater for ColdFusion MX 7 
server that includes all previously released patches. 

Affected Software Versions: 
ColdFusion MX 7.0

Severity Rating: 
Adobe categorizes this issue as a important issue and 
recommends users patch their installations.

Learn more: 
http://www.macromedia.com/go/mpsb05-14 


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
ANY INFORMATION, PATCHES, DOWNLOADS, WORKAROUNDS, OR FIXES 
PROVIDED BY ADOBE IN THIS BULLETIN ARE PROVIDED "AS IS" 
WITHOUT WARRANTY OF ANY KIND. ADOBE AND ITS SUPPLIERS 
DISCLAIM ALL WARRANTIES, WHETHER EXPRESS OR IMPLIED OR 
OTHERWISE, INCLUDING THE WARRANTIES OF MERCHANTABILITY 
AND FITNESS FOR A PARTICULAR PURPOSE. ALSO, THERE IS NO 
WARRANTY OF NON-INFRINGEMENT, TITLE, OR QUIET ENJOYMENT. 
(USA ONLY) SOME STATES DO NOT ALLOW THE EXCLUSION OF 
IMPLIED WARRANTIES, SO THE ABOVE EXCLUSION MAY NOT APPLY 
TO YOU. IN NO EVENT SHALL ADOBE, INC. OR ITS SUPPLIERS BE 
LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING, WITHOUT 
LIMITATION, DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, 
SPECIAL, PUNITIVE, COVER, LOSS OF PROFITS, BUSINESS 
INTERRUPTION, OR THE LIKE, OR LOSS OF BUSINESS DAMAGES, 
BASED ON ANY THEORY OF LIABILITY INCLUDING BREACH OF 
CONTRACT, BREACH OF WARRANTY, TORT (INCLUDING NEGLIGENCE), 
PRODUCT LIABILITY OR OTHERWISE, EVEN IF ADOBE, INC. OR ITS 
SUPPLIERS OR THEIR REPRESENTATIVES HAVE BEEN ADVISED OF 
THE POSSIBILITY OF SUCH DAMAGES. (USA ONLY) SOME STATES 
DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR 
CONSEQUENTIAL OR INCIDENTAL DAMAGES, SO THE ABOVE EXCLUSION 
OR LIMITATION MAY NOT APPLY TO YOU AND YOU MAY ALSO HAVE 
OTHER LEGAL RIGHTS THAT VARY FROM STATE TO STATE. 

Adobe reserves the right, from time to time, to update 
the information in this document with current information. 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
This is a security message from Adobe Systems Incorporated, 
its subsidiaries and affiliates (Adobe), 345 Park Avenue, 
San Jose, CA  95110 USA. If you would prefer not to receive 
e-mail like this from Adobe in the future, please respond 
to this email and include Unsubscribe in the subject line 
or send an e-mail to: 
direct@adobesystems-macromedia.com 

Your privacy is important to us. Please review Adobe's online 
Privacy Policy by clicking here:  
http://www.adobe.com/misc/privacy.html 

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBQ6Jghih9+71yA2DNAQLBWwP/dIvvDNPESxcUw/kQp9Ioamx343rXBnMW
xv8MVEj8x0giJ44PhvnkOFftvg4UDLutEjxe81nOcME3iFbAwPsptKM9UZw+SCUp
LOMQ5ijFK5uewJztMCcnlU4cNvBNscKs//S8VlOKMkk1YyAafxMN9qDDc5fotddt
kwLGnYVlou0=
=ZshH
-----END PGP SIGNATURE-----