Select Page

[Overview]

Adobe ColdFusion is a dynamic web server, a rapid application development platform offered by Adobe Systems that contains advanced features for enterprise integration and internet application development.

[Vulnerability Details]

CVE-2017-11284: This vulnerability is caused by no input validation before the object in the RMI registry is deserialized. An unidentified attacker could exploit this vulnerability by sending maliciously crafted deserialized data to the target application. If this vulnerability is exploited, arbitrary code will be executed remotely on the system with the unwitting victim application’s permission.

Vulnerability Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11284

[Severity]

High-risk

[Impact]

  • Adobe ColdFusion(2016 release)update 4 and earlier
  • Adobe ColdFusion 11 update 12 and earlier

[Fix Suggestions]

  • Turn off port 1099 to prevent ColdFusion from communicating with untrusted networks
  • Upgrade to the latest version or an officially provided fix to prevent attacks

Official statement: https://helpx.adobe.com/security/products/coldfusion/apsb17-30.html

[Hillstone Networks Solution]

Hillstone Networks has added signatures to the signature database: Signature Library Version: 2.1.224. By deploying any Hillstone Networks solution with IPS function, Adobe ColdFusion deserialization vulnerability can be quickly detected and effectively blocked to prevent hackers from exploiting it.


Threat Events Detected by Hillstone Solutions


Vulnerability Detail Description

Hillstone NGFWs Recognized for 8th Straight Year in Gartner® Magic Quadrant™, Named as a “Visionary”

Hillstone Networks Wins 2021 CybersecAsia Readers’ Choice Award

ZTNA: A Better Way to Control Access, Boost Security

Hillstone sBDS V3.4 Extends Supplementary Detection Capabilities

Kudos to the Hillstone Security Research Team for Being Acknowledge by Microsoft for Vulnerability Discovery

Hillstone Releases iSource, an Extended Detection and Response Platform

Hillstone’s A200W streamlines deployment of cost-effective perimeter solution

Endpoint Detection and Response: Getting from Good to Great

ADC V2.9 delivers traffic and balances links at an unprecedented level