Note: This blog post is from 2013. Some content may be outdated--though not necessarily. Same with links and subsequent comments from myself or others. Corrections are welcome, in the comments. And I may revise the content as necessary.

Important hotfix-related notes for ColdFusion 9 and ColdFusion 10

What is this about? and why is it important? Read on below, as the document itself and current links from Adobe don't quite convey its significance, I think. For more perspective, I discuss below both what has happened to many folks after applying ColdFusion security hotfixes in recent years, and how this document helps.

[....Continue Reading....]

Note: This blog post is from 2013. Some content may be outdated--though not necessarily. Same with links and subsequent comments from myself or others. Corrections are welcome, in the comments. And I may revise the content as necessary.

Summary: There is a reasonable explanation and a rather simple solution: update the MySQL driver that CF is using to at least version 5.1.22 of the driver, the first to support MySQL 5.6, because the one built into CF 10 (driver version 5.1.17) not only does not. More important, that older driver uses something that causes the failure above in 5.6.

That explanation of the "solution" may be enough for some to take the ball and run with it (and if not, I will offer more details on how to do that), though it should be noted that updating the driver is not formally supported, nor is MySQL 5.6 technically supported at all in CF10 (or 9). But for those who will press on knowing that risk, you now know what you need to do.

But as often, there's much more to this than meets the eye, so I hope you will follow along to learn more. I have broken this into two parts:

• the problem (with what I hope is helpful explanation of what the real root of the problem is),
• who's to blame (not Adobe, I will argue)
• and the solution (with some caveats that even experienced folks, or those who don't care about "the problem", should still read.

And again, while I discuss this in the context of CF10, where I've seen the problem happen, it could apply also to CF9 (and it seems reasonable that it would), so all the information still applies, it would seem.

[....Continue Reading....]

Note: This blog post is from 2013. Some content may be outdated--though not necessarily. Same with links and subsequent comments from myself or others. Corrections are welcome, in the comments. And I may revise the content as necessary.

Those who know the value of common Windows shortcuts, like alt+tab, ctrl+escape, alt+home, etc., will know those work against your local machine, unless you open a maximized remote desktop in which case they then work against the remote machine. And that's great, of course.

But what if you have a remote desktop opened as a window (one of many apps visible on your local desktop)? You may find it frustrating, if you mean to be doing the equivalent of an alt+tab WITHIN the remote desktop, while viewing it as a windowed app. The keys will again work against your local machine, like with any app.

Is there a way to do such common keyboard shortcut actions against the "windowed" remote desktop? Yes there is. I find that relatively few people know about these, and most are delighted to learn of them! :-)

Summary

See below for more discussion on these, but briefly...

Note first that you can use ctrl+alt+break to toggle a Remote Desktop between full-screen and windowed mode. (If that or these don't seem to work, read the paragraph after the list.) That helps make these shortcuts all the more valuable, once you are viewing the "windowed" remote desktop, where you can use:

• alt+pageUp: to switch application windows on the remote (equivalent of alt+tab)
• alt+pageDown: to switch "backward" through applications (equivalent of alt+shift+tab)
• alt+home: to show Windows "start" menu on the remote (equivalent of ctrl+escape)
• alt+shift+home: to show Windows Task Manager on the remote (equivalent of ctrl+shift+escape)
• alt+del: to show Window menu (top left menu) in current app (equivalent of alt+space)
• ctrl+alt+end: to do the equivalent of ctrl+alt+delete on the remote
• ctrl+alt+plus (the + key): to save screenshot of current remote screen to clipboard (equivalent of PrtSc, the "print screen" button)
• ctrl+alt+minus (the - key): to save screenshot of current remote window to clipboard (equivalent of alt+prtSc)
• alt+ins: to cycle through your remote desktop applications, one app at a time (equivalent of alt+escape)

Again, these shortcuts are for using when you are in a *windowed* remote desktop. Beware also that if any don't seem to "work" for you:

• note that on some keyboards (especially more modern laptops), you may need to press a "function" (or "fn") key to execute the equivalent of one of the keys listed here. For instance, the "break" key may require fn+end, which means that first shortcut above can be a cumbersome four-fingered salute: ctrl+alt+fn+break
• As an update in 2021, on my Asus Zenbook laptops, the break key requires fn-b (and I see the same is true for some Dell laptops), so again it's a four-fingered solute: ctrl+alt+fn+b
• similarly, you may find that you have more than one set of the needed keys, such as pgup/pgdn, on your keyboard. One pair may appear on the top right, and another on the lower right, and/or within the numeric keypad. Be sure to try both, before giving up.
• it could be that you don't have the the keyboard "focus" on the windowed remote desktop session. Click within the remote desktop to be sure
• It may be that your keyboard (especially some modern laptops) may have the pageup, pagedn, home, and other keys used here mapped to some other keycode that Remote Desktop doesn't recognize (even though the keys may "work fine" for you for their normal use on your laptop). I have found a solution to that in 2018 and I intend to do a blog post with more on the solution (until then, check out the tool sharpkeys)

For still more detail and discussion on these keyboard shortcuts, read on.

[....Continue Reading....]

Note: This blog post is from 2013. Some content may be outdated--though not necessarily. Same with links and subsequent comments from myself or others. Corrections are welcome, in the comments. And I may revise the content as necessary.

There is a new Adobe CF blog entry pointing to the new hotfix, and I point that out rather than the technote for the hotfix itself, because as often is the case, there has been some useful discussion related to applying the fix. Indeed, there's a warning I've shared there about a problem (hopefully temporary) with the hotfix file for users of ColdFusion 9.0.2. (Update: the confusion about 9.0.2 is resolved. The technote has been corrected. See the comments in the Adobe blog entry for more details.)

Users of ColdFusion 10, 9.0.2, 9.0.1, and 9.0 should certainly proceed to implement the fix.

I address several questions and other observations about this hotfix below.

[....Continue Reading....]

Note: This blog post is from 2013. Some content may be outdated--though not necessarily. Same with links and subsequent comments from myself or others. Corrections are welcome, in the comments. And I may revise the content as necessary.

At first I was adding these as updates to the previous entry, but I fear that some who may have read it earlier in the day may then miss some of this new info, thus this "Part 2". You will definitely want to read part 1 before proceeding here.

[Update: And since writing this entry 2 weeks ago, Adobe has indeed now come out with a hotfix. I have more to say about that in the new Part 3: Adobe hotfix released for "Serious security threat for #ColdFusion servers". While you should proceed to get that fix in place, you'll likely benefit from reading parts 1, 2, and 3, as there's more discussed than just the thread and fix, itself, which could benefit you down the road.]

Among the new information shared below are such things as how the hack worked (not too much detail, though), how to determine what the exploit may have exposed, how to handle resolving things for many sites via scripting, how to lock down the /adminapi, /administrator, and /componentutils directories, and most important, why you should not skip all this just because "we already block all access to the CFIDE/adminapi" (and /administrator and /componentutils)". There may be exposure you're not considering.

[....Continue Reading....]

Note: This blog post is from 2013. Some content may be outdated--though not necessarily. Same with links and subsequent comments from myself or others. Corrections are welcome, in the comments. And I may revise the content as necessary.

And note that it's NOT one that you're protected against by having applied CF security hotfixes. (Updated Jan 15 2013, as Adobe now has a hotfix for this. More below.)

There's quite a bit for you to consider regarding this recent threat, as I discuss here.

[....Continue Reading....]

Note: This blog post is from 2012. Some content may be outdated--though not necessarily. Same with links and subsequent comments from myself or others. Corrections are welcome, in the comments. And I may revise the content as necessary.

I present the list in two forms: first, just a list of all the entries (31 of them), and second, broken down by category, in case some category may be more interesting to you.

The entries

Here are the 31 entries, in descending order by date.

[....Continue Reading....]

Note: This blog post is from 2012. Some content may be outdated--though not necessarily. Same with links and subsequent comments from myself or others. Corrections are welcome, in the comments. And I may revise the content as necessary.

I have more to say about the list (and such lists) below, but for those who like to "get to the point", here's the list:

[....Continue Reading....]

Note: This blog post is from 2012. Some content may be outdated--though not necessarily. Same with links and subsequent comments from myself or others. Corrections are welcome, in the comments. And I may revise the content as necessary.

This entry discusses the problem and solution.

[....Continue Reading....]

Note: This blog post is from 2012. Some content may be outdated--though not necessarily. Same with links and subsequent comments from myself or others. Corrections are welcome, in the comments. And I may revise the content as necessary.

[....Continue Reading....]