Adobe ColdFusion 9 administrative login bypass
Description
Adobe ColdFusion versions 9.0, 9.0.1, 9.0.2, and 10 contain multiple authentication bypass vulnerabilities that allow remote attackers to circumvent administrative login controls without valid credentials. Four of these vulnerabilities (CVE-2013-0625, CVE-2013-0629, CVE-2013-0631, and CVE-2013-0632) are actively being exploited in the wild against ColdFusion servers. These flaws affect all platforms including Windows, Macintosh, and UNIX systems. Adobe has released security hotfix APSB13-03 to address these critical vulnerabilities.
Remediation
Immediately apply Adobe Security Hotfix APSB13-03 to all affected ColdFusion installations:<br/><br/>1. Download the appropriate hotfix for your ColdFusion version (9.0, 9.0.1, 9.0.2, or 10) from the Adobe security bulletin APSB13-03<br/>2. Review the hotfix installation instructions provided in the Adobe knowledge base article<br/>3. Schedule a maintenance window to apply the hotfix, as it may require a server restart<br/>4. Back up your ColdFusion configuration and applications before applying the patch<br/>5. After installation, verify the hotfix was applied successfully by checking the ColdFusion Administrator version information<br/>6. Monitor server logs for any suspicious authentication attempts that may have occurred prior to patching<br/><br/>If immediate patching is not possible, implement network-level access controls to restrict administrative interface access to trusted IP addresses only until the hotfix can be applied.