CyberInsecure.com

Daily cyber threats and internet security news: network security, online safety and latest security alerts
July 4th, 2009

Drive-by Download Attack Hits Multiple Sites Running Vulnerable ColdFusion Application

Hackers are running a mass compromise against sites running vulnerable ColdFusion application server installations.

Security watchers at the SANS Institute’s Internet Storm Centre are warning that a “high number” of sites have been hit over the last 36 hours or so. Miscreants are exploiting sites running older installations of some ColdFusion applications, such as FCKEditor (a popular HTML text editor) or CKFinder (an Ajax file manager).

The two main strands of the assault both target FCKEditor. Firstly version 8.0.1 of ColdFusion installs a vulnerable version of FCKEditor that is enabled by default. The security flaw creates a means for criminals to upload arbitrary files on affected servers. Details of how to resolve this problem can be found on ColdFusion’s site.

The second strand of the attack relies on third party applications, in particular the CFWebstore e-commerce app, that incorporate vulnerable versions of FCKEditor.

Hackers are taking advantage of the vulnerabilities to plant malicious scripts onto compromised websites, as part of a drive-by download attack that ultimately aims to infect visiting surfers.

SANS reckons the crackers behind the attack are the same as the gang that pulled off a similar attack back in March. Security researchers urge sites to review their ColdFusion installations, paying particular attention to deleting older applications that may have been left around as orphans during systems upgrades.

Credit: The Register

Share this item with others:

More on CyberInsecure:
  • Six Security Vulnerabilities Updated By Adobe In Flash Player 9
  • HP Instant Support ActiveX Control Multiple Vulnerabilities
  • Adobe Patches Critical Flaws In ColdFusion And JRun
  • Apple QuickTime Multiple Remote Vulnerabilities
  • Webwasher Denial Of Service Vulnerability

  • If you found this information useful, consider linking to it from your own website.
    Just copy and paste the code below into your website (Ctrl+C to copy)
    It will look like this: Drive-by Download Attack Hits Multiple Sites Running Vulnerable ColdFusion Application

    Leave a Reply

    Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.

    *
    To prove you’re a person (not a spam script), type the security word shown in the picture. Click on the picture to hear an audio file of the word.