Adobe ColdFusion HTTP Response separation Vulnerability

Release date:
Updated on:

Affected Systems:
Adobe ColdFusion 9.x
Adobe ColdFusion 8.x
Description:
--------------------------------------------------------------------------------
Cve id: CVE-2012-2041

Adobe ColdFusion is a dynamic Web server.

Adobe ColdFusion 8.0 to 9.0.1 does not properly filter some input and returns it to the user. The implementation of the CRLF Injection vulnerability can be exploited to insert arbitrary HTTP headers and perform HTTP Response isolation attacks.

<* Source: Michael Dominice

Link: http://secunia.com/advisories/49517/
Http://www.adobe.com/support/security/bulletins/apsb12-15.html
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Adobe
-----
Adobe has released a Security Bulletin (apsb12-15) and patches for this:

Apsb12-15: Security update: Hotfix available for ColdFusion 9.0.1 and earlier

Link: http://www.adobe.com/support/security/bulletins/apsb12-15.html