A security issue has been reported in Adobe ColdFusion MX, which can be exploited by malicious, local users to gain escalated privileges.

The security issue is caused due to the application having certain files and directories with insecure permissions i.e. world writable. This can be exploited to gain escalated privileges at the next server restart by replacing or editing the affected files.

The security issue reportedly affects versions 7.x.

Solution
The vendor recommends applying updates for the cfroot/verity directory and setting the permissions on various directories. Please see the vendor's advisory for details.

Provided and/or discovered by
The vendor credits:
* Sean Larsson, iDefense Labs
* Hans Omli, Shoe String Ventures

Original Advisory
Adobe:
http://www.adobe.com/support/security/bulletins/apsb07-08.html

iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=510

Deep Links
Links available in Customer Area