Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I saw the new secruity hotfix for ColdFusion on adobe.com, but I'm unsure what is already installed. The version in ColdFusion Administrator is 8,0,1,195765.

How can I tell which ColdFusion hotfixes are installed?

Can I attempt to install a Cumulative hotfix without a problem?

share|improve this question
add comment

3 Answers 3

If I remember correctly, ColdFusion hotfixes consist of a simple "replace some files".

To verify the installation status of a hotfix, there likely isn't any way other than to verify those files directly.

Installation of a cumulative hotfix should be safe regardless of current hotfix levels.

share|improve this answer
add comment

As Shane said, most have been just replacing files. In some cases there are additional JARs added. On a CF9 install they're in /opt/coldfusion9/lib/updates/ but I think that location is the same for CF8.

You could also look at this http://www.dcepler.net/post.cfm/file-integrity-checking-cfide which uses something called hashdeep and a pre-generated hash file to determine if your CFIDE matches the patched version.

share|improve this answer
add comment

On both ColdFusion 8 and 9 hotfixes are installed to the {coldfusion-install}/lib/updates directory. Hotfixes are identified in the directory as hfvvv-xxxxx.jar where vvv is the version of ColdFusion and xxxxx is a bugid for a specific fix. Security hotfixes follow the same convention but the xxxxx is a sequential number. The last security hotfix for ColdFusion 8.0.1 (APSB12-21) is hf801-00007.jar.

Cumulative hotfixes are located in the same directory but are identified by chfvvvxxxx.jar, again where vvv is the version of ColdFusion and xxxx is a sequential number. The last Cumulative Hotfix for ColdFusion 8.0.1 is chf8010004.jar.

If you need an easy way to make sure your ColdFusion 8.0.1 or 9.0.x server is patched correctly, I'd recommend using Unofficial Updater 2

While what Ian linked to will be able to tell you if the contents of the CFIDE directory are correctly patched, there are files in other directories, particularly on ColdFusion 8.0.1 that need to be updated to be fully patched.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.