Inge Henriksen has reported a vulnerability in Adobe ColdFusion MX, which can be exploited by malicious people to disclose potentially sensitive information.

The vulnerability is caused due to an input validation error when processing URL-encoded file names. This can be exploited to view arbitrary files on the web root via a specially crafted URL with a doubly-encoded NULL byte and an extension that is handled by ColdFusion e.g. ".cfm".

The vulnerability is reported in version 7.0.2 running on Windows IIS. Other versions may also be affected.

Solution
Apply hotfix (See vendor's advisory for details).
Further details available in Customer Area

Provided and/or discovered by
Discovered by Inge Henriksen and reported via iDefense Labs.

Original Advisory
Adobe:
http://www.adobe.com/support/security/bulletins/apsb07-02.html

iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=466

Deep Links
Links available in Customer Area