Sameeksha

Critical update for ColdFusio 10 and earlier released : May 2013

2013-05-14T21:09:00.001+05:30

A security update for ColdFusion is now available for versions 10, 9, 9.0.1 and 9.0.2. This hot-fix addresses issues reported in Advisory 13-03

If you are on ColdFusion 10, you will see a new update 10 within the ColdFusion administrator for you to download and install. Adobe recommends users update their product installation with this update. Here's a link to the related security bulletin.

As an additional precaution, we recommend commenting RDS servlet in web.xml

It highly recommended that all public facing servers are locked down properly to prevent against unknown attacks.Recently we have seen increased number of attacks on Administrator or RDS functionality of ColdFusion. These are internal components and are meant to be kept blocked for any external access. A lot of attacks will be prevented and will fail if the servers are properly locked down. Complete instructions for protecting server can be found accessed here. ColdFusion 10 Lockdown Guide, ColdFusion 9 Lockdown Guide

ColdFusion has added a lot of new functionality to secure applications and has improved security in general, due caution is warranted to secure the server installation and internal applications to prevent security attacks.

Security HotFix for ColdFusion 9 and above- April 2013

2013-04-10T00:19:00.000+05:30

An important security update for ColdFusion is now available for versions 10, 9, 9.0.1 and 9.0.2.

If you are on ColdFusion 10, you will see a new update 9 within the ColdFusion administrator for you to download and install.

Adobe recommends users update their product installation with this update. Here's a link to the related security bulletin.

Note: It is recommended that, request related functionality is not used with CFThread.

Critical Security update available for ColdFusion 9 and above

2013-01-15T22:31:00.000+05:30

A critical update is released today for ColdFusion 9 and above. Adobe recommends to update the ColdFusion servers. Here is the link for security bulletin.

This update fixes vulnerabilities reported in public advisory released on 4th January 2013. You can find the advisory here.

The list of CVEs getting addressed are - CVE-2013-0625, CVE-2013-0629, CVE-2013-0631 & , CVE-2013-0632. The hotfix resolves authentication bypass vulnerabilities and information disclosure vulnerability.

For ColdFusion 10, use updater to get this update. This is update 7 and it contains previous updates for ColdFusion 10. The details can be found at tech-note here.

Personally I highly recommend securing every public facing server (including unsupported versions). Access to internal components like Administrator, CFCExplorer, AdminAPI etc. should be blocked for any unwanted access or should be under IP address restriction. Adding link for reference to Lockdown guides here. coldFusion 9 Lockdown Guide & ColdFusion 10 Lockdown Guide.

Security HotFix for ColdFusion 9 and above- December 2012

2012-12-11T22:05:00.000+05:30

A priority 2 update addressing an important vulnerability in ColdFusion 9 and above is released today. Adobe recommends to update the ColdFusion servers. Here is the link for security bulletin.

This hot fix resolves a vulnerability which could result in a sandbox permissions violation in a shared hosting environment - CVE-2012-5676. As a result to this fix named application scope will not be available in servlet context. This might affect applications using JSP interoperability.

In case you want to revert to old behavior you can add JVM flag -Dcoldfusion.allowappdatainservletcontext=true

For ColdFusion 10, use updater to get this update. This is update 6 and it contains previous updates for ColdFusion 10.
The details can be found at tech-note here.

Security guide & ColdFusion 10

2012-11-30T22:50:00.002+05:30

Recently lot of useful resources are made available for faster, better and secure development with ColdFusion 10. Security lock-down guide is latest addition to ColdFusion 10 resources.

Loaded with useful tips and best practices, this guide will help users secure their ColdFusion servers. you can find the guide located here.

The guide talks about installation related best practices, administrator settings for configuring server, adding protection for administrator and other internal resources and a lot more.Using this guide with other best practices and security enhancements, you can write secure application and protect ColdFusion server environment.

ColdFusion 10 update 5 released

2012-11-20T08:42:00.001+05:30

Update 5 for ColdFusion 10 is released to fix an important vulnerability By exploiting this vulnerability one could crash app pool for IIS. This fix is windows specific. More details can be found here.

Note that this update is only required for ColdFusion 10 update 1 and above.

ColdFusion 10 update 3 released with critical fixes

2012-10-16T21:53:00.002+05:30

Yes, the title says it all, Update 3 for ColdFusion 10 is released today. This fixes connector related important issues. ColdFusion blog and technote lists all details about this. T

Note: Don't forget to apply mandatory update before installing this.

Note: [02-11-2012]: Update 4 is released fixing some important issues. See full details here.

Prevent accidental manipulation of ColdFusion session cookies

2012-09-20T13:51:00.001+05:30

In ColdFusion 9.0.2 and earlier, people needed to modify ColdFusion session cookies for adding additional cookie attributes. With ColdFusion 10, this is no longer required. (For details see here).

So now while migrating to ColdFusion 10, this code needs to be updated. Let's see the scenario when this code is left out. The behavior is unknown. To avoid this, ColdFusion 10 comes with another setting -

Settings -> Memory Variables -> Session Cookie Settings -> Disable updating ColdFusion internal cookies using ColdFusion tags/functions

It can also be set using Application.cfm/cfc. See this entry for details.

When enabled this will prevent CFCookie and CFHeader tags to update ColdFusion session and authorization cookies.

There is one more enhancement done for cfcookie/cfheader - In previous versions, cookie value was always encoded. However this might cause issues with a cookie value expected with some extra characters. Now you can use new attribute "preservecase" and "encodevalue" for CFCookie tag and "encoded" attribute for CFHeader tag when type=cookie.

Security Hot-Fix for ColdFusion - September 2012

2012-09-11T21:23:00.000+05:30

Today, a priority 2 update is released, addressing an important vulnerability in ColdFusion 10 and earlier. It also addresses this for ColdFusion 8.0.1 and ColdFusion 8. Adobe recommends to update the ColdFusion servers. Here is the link for security bulletin.

This hot-fix addresses resolves a vulnerability which could result in a Denial of Service (DoS) attack - CVE-2012-2048. You should update your sandboxes to add GetPageContext() method in disabled functions list.

For ColdFusion 10, use updater to get this update. This is update 2 and it contains previous update 1 for ColdFusion 10.
The details can be found at tech-note here.

Note: This is the last Security Hot-Fix for ColdFusion 8.0.1 & 8.

SSLV3 support in ColdFusion

2012-09-03T18:21:00.002+05:30

Have some inputs on SSLV3 support in ColdFusion? Would like to share the SSLV3 use cases for your applications for ColdFusion?

Share it with ColdFusion team, at http://blogs.coldfusion.com/post.cfm/coldfusion-sslv3-support

ColdFusion 10 update 1 is live

2012-09-01T11:07:00.003+05:30

Update 1 for ColdFusion 10 is released today. This update fixes 20+ important/critical issues. The best part is, you don't need to do manual steps to install this update. You now will get a notification in Administrator in case auto check was enabled. If not, then you should check for updates using ( Hot-Fix installer ) server updates section on Administrator and install the update.

This update fixes the following issues -

Bug ID	Description
3177732	Missing CGI.Redirect_* variables (for example, CGI.Redirect_URL, CGI.redirect_query_string) in ColdFusion 10.
3305486	The value of CGI.path_info is an empty string when URL rewrite condition uses {PATH_INFO} in IIS.
3181617	ORM 2nd level cache does not function when application is restarted after timeout.
3197628	cfcompile.bat and cfcompile.sh missing from ColdFusion 10.
3209606	When request debugging is enabled in "Secure Profile" mode, error template does not display correctly.
3207446	Unable to send certain set of characters as a message over websocket.
3290529	Unable to access Coldfusion Collections in spite of necessary permissions being granted to a user.
3306430	Data overflows from columns within a table in PDFs generated using cfdocument tag.
3192032	Scheduled Tasks belonging to non-default group are not archived.
3198173	cfhttp fails for a URL whose response is gzipped.
3198902	ExpandPath with UNC path is VERY slow.
3218452	CFThread fails when called from Custom Tags.
3295296	ColdFusion 10 returns multiple form fields with the same name as arrays instead of lists.
3306457	ColdFusion 10 deploys incorrect DLLs when installed as a 32–bit application on a 64 bit machine, there by causing functionality such as registering CFX C++ tags to fail.
3183743	When the value of action attribute of cfschedule tag is "list", incorrect interval information is returned.
3194817	*(ColdFusion 10 Standard Edition only)* Can't create recurring scheduled jobs.
3196328	An application specific task that is paused cannot be listed.
3196336	Exception in the ColdFusion Administrator when viewing a task if the value of its exclude attribute is an array.
3203769	Editing a paused task which has a password specified changes its status to running.
3295644	Scheduled Task that executes a URL on a specific port reverts back to 80 on server restart.
3208222	Error when instantiating a COM Object in ColdFusion 10.
3299932	When a scheduled task is created with "Recurring" or "One-Time" option, it loses the the username and password information on server restart.

Complete details can be found at tech-note on this location - http://helpx.adobe.com/coldfusion/kb/coldfusion10-update-01.html

Slides & Recording of e-seminar on ColdFusion 10 & security enhancements

2012-08-19T20:32:00.002+05:30

Recording for e-seminar on ColdFusion 10 Security enhancements with Title: Securing applications with ColdFusion 10 Security Enhancements is available now. Due to bad voice quality we have re-recorded it and made it available for you. See the complete session here.

You can also get the slides here.

ColdFusion Roadmap is available

2012-08-14T10:38:00.000+05:30

ColdFusion roadmap for next two major releases is available Here. This provides high level themes, directions for the product.

Note: The intended future features/directions described in this document are under consideration by Adobe Systems and are not commitments for future products, technologies, or services. The roadmap is subject to change at Adobe Systems’ sole discretion and Adobe Systems does not guarantee the features or release dates.

ColdFusion e-Seminar on Securing Application

2012-07-25T09:51:00.001+05:30

Securing applications with ColdFusion 10 security enhancements

July 25, 2012

The session will include best practices for writing secure applications. It will discuss the new APIs and features added in ColdFusion 10. We will do hands on/Examples of each category. The session will also include brief about hot-fix installer and Secure profile features. We will end with discussing some of the configurations which can help largely protect an application.

Recordings & Slides at: http://www.shilpikhariwal.com/2012/08/catch-e-seminar-on-coldfusion-10.html
To Register click here

There are more e-seminar upcoming this month. For complete list check out this

Security Hot-Fix released for ColdFusion - June 2012

2012-06-12T23:53:00.000+05:30

Today, a priority 2 update is released, addressing an important vulnerability in ColdFusion 9.0.1 and earlier. Adobe recommends to update the ColdFusion servers. Here is the link for security bulletin.

This hot-fix addresses HTTP response splitting vulnerability in ColdFusion component browser - CVE-2012-2041

The details can be found at tech-note here.

Note: This issue does not affect ColdFusion 9.0.2 and 10

ColdFusion 10 & Image Enhancements

2012-06-05T14:21:00.001+05:30

With ColdFusion 10 there are some image enhancements done. Here is a list of those enhancements -

1. Image Resize and interpolation: With ImageResize and ImageScaleToFit , interpolation is one of the parameters. This Interpolation argument control quality of resultant image. This has an impact on performance. Higher the quality, slower the response time will be. Possible value for this argument are highestQuality (default), highQuality, mediumQuality, highestPerformance, highPerformance, mediumPerformance, nearest, bilinear, bicubic, bessel, blackman, hamming, hanning, hermite, lanczos, mitchell, quadratic.

With ColdFusion 10, this support is added in cfimage tag as well. Now for cfimage action="resize", interpolation is one of the possible attribute. Default value is kept in sync with the function equivalents of this action.

2. ImageDrawText: ImageDrawText method will now return a struct containing the width of the text drawn and the height of the text drawn.

3. CMYK Image support: CMYK Images were not working for Mac and 64bit OS. we have added support for the same.

4. Fixed a bug in ImageGrayScale with TiFF images.

5. Captcha Creation: ImageCreateCaptcha method support is added.

ImageCreateCaptcha(int height, int width, String text)
ImageCreateCaptcha(int height, int width, String text, String difficulty)
ImageCreateCaptcha(int height, int width, String text, String difficulty, String fonts, int fontSize)

6, Change in behavior for action="captcha":  Added name attribute to action="captcha" for cfimage tag. This new attribute name will contain the image variable object.Now inline captcha will be rendered only when name and destination are not specified. Else if name is specified, image will be saved in variable like other image functions. If destination is specified, captcha image will be saved at the location mentioned.

7. For cfimage action = "captcha", if user specified font is not found, it will fall back to system fonts

8. ImageMakeColorTransparent: New method ImageMakeColorTransparent is added. This will create an image and set a transparent color

ImageColorTransparent(img, color)

9. ImageMakeTranslucent: New method ImageMakeTranslucent  is added. This will create a new translucent imagewith given percentage of translucence

ImageMakeTranslucent (img, percent)

10. New Parameters for ImageOverlay: New parameters rule and alpha are added for the function ImageOverlay.

ImageOverlay(source1, source2, [rule, alpha]))

For detailed information on all these APIs refer to ColdFusion 10 documentation.

If you see memory leak you can explore using memory leak fix done by Jpedal for JAI. You can read about it and download from here.

WebSphere & Cookie Expires Format

2012-06-03T15:00:00.000+05:30

On IBM Websphere 7.0 all session cookie related test cases might fail. This happens because of the following bug in Websphere

Here are some details :

Based on RFCs, the cookie expire date format is DD-Mon-YYYY HH:MM:SS GMT. (RFC 822, RFC 850, RFC 1036, and RFC 1123)

But in WebSphere 7 it comes as DD-Mon-YY HH:MM:SS GMT

So on the browsers which doesn't recognize this expire date format, ColdFusion administrator and other session related stuffs (which uses session cookies) may break.

ColdFusion 9.0.2 is released

2012-06-01T16:46:00.002+05:30

ColdFusion 9.0.2 is released this week. It is mainly to remove Verity bits. It also contains all hot-fixes ( Cumulative and Security ), so to me it sounds a great deal. You can download from here.

Other supporting documentation can be found at -

Background Story on 9.0.2

Release notes

Availability of CF 8 , CF9/9.0.1 installers

ColdFusion Developer week is back

2012-05-30T12:29:00.002+05:30

Want to learn all new ColdFusion 10 features??? Liked Developer week which happened last year??? So here is your chance to attend this year's ColdFusion Developer Week between the 4^th and 8^th June.

With the launch of ColdFusion 10, 2nd ColdFusion Developer Week, a series of free, live webinars hosted by seasoned ColdFusion experts is being organized. The webinars will cover a wide range of topics, from what ColdFusion is and how to code it, to more in-depth topics related to CF10- HTML5, REST, ORM, Security enhancements and more.

If you are a new developer, someone with little or no ColdFusion experience, or even if you have been using ColdFusion all your life, these sessions are ideal for you. The ColdFusion Developer Week provides something for everyone so signup now.

Details of this year’s session list is :

Title	CF/ CF10/ Generic
Getting Started with Web Application Development Using ColdFusion	Generic
What's new in CF10	CF10
RESTful WebServices made easy in ColdFusion 10	CF10
Power your ColdFusion 10 apps with HTML5 WebSockets	CF10/ HTML5
Hidden gems in ColdFusion 10	CF10
Improve your apps through unit testing	Generic
Building applications using ColdFusion 10 and ORM	CF10
Using ColdFusion frameworks for Application development	Generic
ColdFusion Builder: The professional IDE to Boost Your Productivity	CF10
Everything that you need to know about Tomcat in ColdFusion 10	CF10
Get productive using the language enhancements in ColdFusion 10	CF10
Leverage the productivity of ColdFusion within Java SpringMVC	Generic/Java
Secure your apps using ColdFusion 10	CF10
User Experience upgrade through HTML5 charts and videos	CF10/ HTML5
Make Your Site Searchable with ColdFusion 10 and Solr	CF10
What's new in CF10
Speed your websites using Caching in ColdFusion 10	CF10
Adobe ColdFusion : The most popular server side platform for PDFs	Generic
Revamped Scheduled Tasks in ColdFusion 10	CF10

ColdFusion 10 Security Improvements on Adobe Developer Connect

2012-05-22T23:03:00.001+05:30

Find how to protect against XSS, CSRF, Session Handling, Clickjacking and much more with ColdFusion 10 in the detailed article by me.

ColdFusion 10 & ColdFusion Builder 2.0.1 is released

2012-05-15T10:57:00.000+05:30

After much wait, today ColdFusion 10 and ColdFusion Builder 2.0.1 are released. Loaded with features like HTML5, REST, Security enhancements, Hot-Fix installer, Client Side chart and much much more, i find it like a dynamite. Check out more details at -

ColdFusion 10 & ColdFusion Builder 2.0.1

Troubleshooting with JBoss 7

2012-04-16T15:27:00.000+05:30

Recently I coming across a lot of configurations that are required for new servers like JBoss 6 & 7. So I thought of jotting them at a single place. I may be mentioning them in brief sometimes and sometimes I would provide as much detail as I can.

JBoss & Cookie Expiry : With JBoss 6 and 7, cookies by default specify the expiration time of cookie as "Max-Age" header attribute instead of "Expires". I have written a detail about this here.

Random number generation and server start up is slow on Unix platforms for some of the servers. This is because of /dev/random is used in Unix platforms for random number generation. I have added a detail entry explaining the problem and solution here.

JBoss 7 AS, has modular class loading. It provides true application isolation, hiding server implementation classes from application and only loading the classes your application needs. Modules, packaged as collections of classes, are peers that remain isolated unless explicitly defined as a dependency of another module. These visibility rules can be customized.

Due to this design, JBoss modules does not load everything from rt.jar and many other system jars by default. As a result you may get ClassNotFoundException or NoClassDefFounfError for a lot of classes. Read here for solution and workarounds available for this.

When running Jsafe library on JBoss, if you get error like java.lang.NoClassDefFoundError put the jsafe (CryptoJ) jars to <JAVA_HOME>/jre/lib/ext directory. This mostly occurs on Unix platforms.

In JBoss version 7 or above if open office is not working start JBoss with flag -Djava.ext.dirs=<jboss-deployment-dir>/cfusion.ear/cfusion.war/WEB-INF/cfusion/lib/oosdk/:<java-home>/lib/ext/ .

I will keep updating this space as and when i will find more.

JBoss 7 & Sandbox

2012-04-16T15:25:00.000+05:30

JBoss 7 AS, has modular class loading. It provides true application isolation, hiding server implementation classes from application and only loading the classes your application needs. Modules, packaged as collections of classes, are peers that remain isolated unless explicitly defined as a dependency of another module. These visibility rules can be customized.

Due to this design, JBoss modules does not load everything from rt.jar and many other system jars by default. As a result you may get ClassNotFoundException or NoClassDefFounfError for a lot of classes.

Example:

com.sun.imageio.*

javax.annotation.processing.*

com.aqua.LookAndFeel

Open Office, web services tests might fail

Solution: jboss-deployment-structure.xml -

To Fix this the solution is to, use a jboss-deployment-structure.xml in your war as explained here https://docs.jboss.org/author/display/AS7/Class+Loading+in+AS7

Example:

<jboss-deployment-structure xmlns="urn:jboss:deployment-structure:1.1">
    <deployment>
        <dependencies>
         <module name="deployment.system"/>
        </dependencies>
    </deployment>
    <module name="deployment.system">
     <dependencies>
         <system export="true">
             <paths>
                 <path name="com/sun/net/ssl/internal/ssl"/>
             </paths>
         </system>
     </dependencies>
    </module>
</jboss-deployment-structure>

However if for some reason you can't add jboss-deployment-structure.xml quickly in your application following are 2 workarounds.

Workarounds 1: For JRE System classes, There is a modue named "sun.jdk" that depdends on module "system". Here are defined all packages jboss loads from rt.jar.

In this module.xml of /sun/jdk/main directory add the required packages as -

etc, according to the need of application.

Example:

<resource-root path="service-loader-resources"/>

</resources>

<include-set>

</include-set>

</exports>

</module>

</dependencies>

</module>

Workaround 2:

Add jboss.modules.system.pkgs system property with comma separated list of packages to load.

-Djboss.modules.system.pkgs=com.sun.imageio.spi,javax.annotation.processing

Additional Information:

Related issues -

https://community.jboss.org/message/627008

https://community.jboss.org/message/608523
https://community.jboss.org/thread/177472

JBoss cfusion.ear/war deployment timeout:

If cfusion.ear is not deployed within the deployment timeout for jboss you can change the deployment timeout of jboss in standalone.xml

<deployment-scanner scan-interval="5000"

relative-to="jboss.server.base.dir" path="deployments" deployment-timeout=”120”,/>

</subsystem>

Profiling:

Performance tuning is an important part any application development. In order to use JProfiler ofor jboss 7, first you need to add the following to your standalone.conf file:

JAVA_OPTS="$JAVA_OPTS -Djboss.modules.system.pkgs=com.jprofiler -agentlib:jprofilerti -Xbootclasspath/a:/path/to/jprofiler/bin/agent.jar"

The "jboss.modules.system.pkgs" property tells JBoss Modules to allow the "com.profiler" classes to be found from any class loader, which is essential to allow the JProfiler agent to run. It is easier to then just set up your jprofiler sessio nas "Remote", and start the server and profiler.

Random number generation in Unix & Performance

2012-04-13T13:06:00.000+05:30

Random number generation and server start up is slow on Unix platforms for some of the servers. This is because of /dev/random is used in Unix platforms for random number generation.

I am including an explanation and solution here. Feel free to go to Solution directly in case you understand the problem already.

java.security.SecureRandom is designed to be crypto secure. It provides strong and secure random numbers. SecureRandom should be used when high-quality randomness is important and is worth consuming CPU.

SecureRandom uses OS provided entropy for generating strong random numbers. Depending on the machine and environment, sources of entropy varies. The Operating system knows how and where to collect the entropy from. So it collects this entropy and makes it available via an API like CryptGenRandom() on windows and by reading from /dev/random device file for Unix like systems e.g. Linux, Solaris, Mac.

To obtain a series of bytes of entropy, you can call `SecureRandom.getSeed()`, with an instance of `SecureRandom`. For Oracle Java, `SecureRandom.generateSeed()` is a wrapper for os provided source of entropy, if one is available.

For Unix platforms /dev/random this entropy is generating by recording user actions with devices such as mouse clicks, key board strokes, arriaval/access to disk/network packets etc.

While using SecureRandom, you should keep following in mind:

in the worst case, the call SecureRandom.generateSeed() may block until the required entropy has been generated.
you should consider bits of entropy as a "valuable, shared resource"— if you request entropy faster than it is generated, then your application will block, and so potentially will other applicatons also requesting entropy.

This is exactly the problem that causes these servers to load slow. The alternative to this is /dev/urandom.

The difference between /dev/random and /dev/urandom is that
/dev/random provides a limited (but relatively large) number of random bytes, and will block waiting that the kernel gives some more if the buffer is outrun,

while /dev/urandom will always provide random bytes though they may become of a lesser quality once the initial buffer is outrun. However note that I am not implying that it is not secure at all.

Before Java 1.5, you could tell java to use /dev/urandom in case the application has higher need of performance. However Java 1.5 onward, using "/dev/urandom" is ignored and /dev/urandom file is mapped to /dev/random. See Bug 6202721.

Solutions:
There are some solutions mentioned on the internet. I will list all those and then will highlight the one which i found working perfect in all situations -

Leave it as is where /dev/random is used (even if set to /dev/urandom) and use some third party tool to introduce sufficient random entropy into your system so /dev/random doesn't block so slowly.
Add “-Djava.security.egd=file:/dev/./urandom” (/dev/urandom does not work) to java parameters.
mv /dev/random /dev/random.ORIG ; ln /dev/urandom /dev/random
Change $JAVA_HOME/jre/lib/security/java.security. Replace securerandom.source with securerandom.source=file:/dev/./urandom.

Note: #1 is the best solution and most secure. However for development phase and test environments (even for systems where you are ready to compromise on security), #4 solution is what I used and I recommend.

Hope this explains and saves some time for you all.
Have fun.

ColdFusion 10 & Secure Profile

2012-04-11T19:57:00.000+05:30

How many times Administrators might have wondered what all to configure to make the server release ready and secure. There are different guidelines and recommendation documents out there.

With ColdFusion 10, option to have Secure Profile enabled is added at installation time. It is recommended to choose this for production or public facing servers. When selected, this will enforce a lot of security related configurations enabling fewer configurations required by administrator to secure the server.

At time of installation if secure profile is chosen, following settings are affected –

1. Separate username and password setting is enabled for Administrator &RDS

2. RDS service is disabled

3. A List of IP addresses are asked which should have access to Administrator

4. Strong and complex password for root admin user is mandatory

5. Directory Browsing is disable in server

6. Custom and least information error templates are used

7. All debugging is disabled

8. For a new data source default allowed SQL are select, insert, update, delete

9. Below is a list of some more settings on server level which are affected -

Administrator settings affected by enabling Secure Profile -

	Administrator Settings	Path	Default Admin Profile	Secure Profile	Changes to the setting
1	Use UUID for cftoken	Server Settings > Settings	Enabled	Enabled	Overwritten
2	Disable access to internal ColdFusion Java components	Server Settings > Settings	Disabled	Enabled	Overwritten
3	Enable Global Script Protection	Server Settings > Settings	Enabled	Enabled	Overwritten
4	Maximum size of post data	Server Settings > Settings	20MB	20MB	Overwritten
5	Missing Template Handler	Server Settings > Settings	no value	Custom missing error template	Retained if specified
6	Site-wide Error Handler	Server Settings > Settings	no value	Custom site-wide error template	Retained if specified
7	Request Queue Timeout Page	Server Settings > Request Tuning	no value	Custom error template	Retained if specified
8	Cookie Timeout	Server Settings > Memory Variables	15767000 minute	1440 minute	N/A
9	Disabling updating of ColdFusion internal cookies using ColdFusion tags/functions	Server Settings > Memory Variables	Disabled	Enabled	N/A
10	Enabled WebSocket Server	Server Settings > WebSocket	Enabled	Disabled	N/A
11	Start Flash Policy Server	Server Settings > WebSocket	Enabled	Disabled	N/A
12	Allowed SQL (all settings)	Data & Services > Data Sources ><database> > Advanced Settings	Enabled	Create, Drop, Alter, Grant,Revoke, Stored Procedures are disabled	Retained if specified
13	Enable Robust Exception Information	Debugging & Logging > Debug Output Settings	Disabled	Disabled	Overwritten
14	Enable CFSTAT	Debugging & Logging > Debug Output Settings	Enabled	Disabled	Overwritten
15	Select the type of Administrator authentication	Security > Administrator	Use a single password only	Separate user name and password authentication (allows multiple users)	N/A
16	Enable RDS Service	Security > RDS	Configurable at install time	Disabled	N/A
17	Select the type of RDS authentication	Security > RDS	Use a single password only	Separate user name and password authentication (allows multiple users)	N/A
18	Allowed IP addresses for ColdFusion Administrator access	Security > Allowed IP Addresses	Not available at install time	Available at install time	N/A

Ray has created a very nice Administrator Extension. The details can be found as Security Profile Admin Extension for ColdFusion 10

Sameeksha

Critical update for ColdFusio 10 and earlier released : May 2013

Security HotFix for ColdFusion 9 and above- April 2013

Critical Security update available for ColdFusion 9 and above

Security HotFix for ColdFusion 9 and above- December 2012

Security guide & ColdFusion 10

ColdFusion 10 update 5 released

ColdFusion 10 update 3 released with critical fixes

Prevent accidental manipulation of ColdFusion session cookies

Security Hot-Fix for ColdFusion - September 2012

SSLV3 support in ColdFusion

ColdFusion 10 update 1 is live

Slides & Recording of e-seminar on ColdFusion 10 & security enhancements

ColdFusion Roadmap is available

ColdFusion e-Seminar on Securing Application

Security Hot-Fix released for ColdFusion - June 2012

ColdFusion 10 & Image Enhancements

WebSphere & Cookie Expires Format

ColdFusion 9.0.2 is released

ColdFusion Developer week is back

ColdFusion 10 Security Improvements on Adobe Developer Connect

ColdFusion 10 & ColdFusion Builder 2.0.1 is released

Troubleshooting with JBoss 7

JBoss 7 & Sandbox

Additional Information:

Random number generation in Unix & Performance

Random number generation and server start up is slow on Unix platforms for some of the servers. This is because of /dev/random is used in Unix platforms for random number generation.

To obtain a series of bytes of entropy, you can call SecureRandom.getSeed(), with an instance of SecureRandom. For Oracle Java, SecureRandom.generateSeed() is a wrapper for os provided source of entropy, if one is available.

ColdFusion 10 & Secure Profile

To obtain a series of bytes of entropy, you can call `SecureRandom.getSeed()`, with an instance of `SecureRandom`. For Oracle Java, `SecureRandom.generateSeed()` is a wrapper for os provided source of entropy, if one is available.