What hotfixes should be applied to a ColdFusion 8 Server

Question

I've recently inherited a server running ColdFusion 8 and believe it may not have been patched for security updates (as per http://www.adobe.com/support/security/#coldfusion) for quite some time.

The Coldfusion installation is 8.0.1 (8,0,1,195765), but I don't see any other information to see which patches have been installed from the 13 shown on the Adobe security page.

Is there a way I can tell which patches have been installed? If not, can I tell which we're included in 8.0.1 so I don't have to include these?

Additionally, it looks like some updates contain other older ones - can I get away with only installing the latest update (listed to fix APSB11-14) or do I need some others as well?

Answer 1

As Shane said "It'd be less effort to just re-apply all the patches." - true, and false. You will get all kinds of weird problems if you don't return your installation to an un-patched state first. The crappy thing about it is "there is no good and/or easy way to determine what patches are installed"

you will need to look at each patch, hotfix & cumulative update, read it's installation instructions & look for the files it tells you to replace & do a checksum on them to determine if they have been patched or not. One or more of the cumulative updates has you update the CFIDE files as well, hopefully, the last admin kept the backup.

Adobe's advice on hotfixes is "if you are experiencing this problem ... then apply this patch" if not - don't, all security patches should be installed.

Good luck, I've been down this road myself & it really sucks trying to figure out what is/needs to be installed...

Is this a live/production machine? You may be further ahead reinstalling & patching from there

-sean

Answer 2

ColdFusion security updates usually take the form of "plop these newer files on top of the old versions" - to check, you'd probably need to do size or hash comparisons of the new/old versions of the files.

It'd be less effort to just re-apply all the patches.

Some of the updates will touch overlapping files, but only if that file needed to be updated multiple times - if a file's touched multiple times, then only apply the newer update, but they aren't necessarily aggregate.