Secunia

Amit Klein has discovered a vulnerability in ColdFusion MX and JRun, which can be exploited by malicious people to cause a DoS (Denial-of-Service).

The vulnerability is caused due to an unspecified error within the handling of SOAP requests when expecting an array of objects. This can be exploited to exhaust a large amount of CPU and memory resources, which will increase response times and may generate out-of-memory errors.

The vulnerability affects the following versions:
* Macromedia ColdFusion/MX 6.0 and 6.1
* Macromedia ColdFusion/MX 6.0 and 6.1 J2EE (all editions)
* Macromedia JRun 4.0 (all editions)

NOTE: Default installations of ColdFusion MX and JRun have no deployed web services and are therefore not affected.

Solution
Apply patch:
Further details available in Customer Area

Provided and/or discovered by
Amit Klein, Sanctum Inc.

Original Advisory
http://www.macromedia.com/devnet/security/security_zone/mpsb04-04.html

Deep Links
Links available in Customer Area