ColdFusion Muse

ColdFusion and JVM Versions and SSLv3-TLS Security Magic

Mark Kruger December 8, 2014 2:52 PM ColdFusion, Coldfusion Security Comments (13)

This is the second entry by Wil Genovese (Trunkful.com) in our effort to provide a complete picture of how CF, Various versions of JVMs and various versions of SSL all work together. Wil's previous article on Surviving Poodle detailed a blow by blow description of how to troubleshoot a system broken due to the upgrading of SSL. This article includes some detailed technical information as well as the results of some painstaking tests. It is our hope that it will serve as a guide. It represents yet another reason to insure that you are upgrading to the latest JVM and CF version. Take it away Wil:

Read More
  • Share:

Surviving Poodle - ColdFusion and SSL 3

There's been a great deal of buzz about poodle. Poodle is an SSL exploit capable of highjacking a session using a browser's ability to "negotiate downward" the level of SSL it uses. It's recent prolifieration has put some urgency into the efforts to force existing applications and platforms to deny the use of any standard of SSL less than version 3.0. Super guru Wil Genovese (Trunkful.com) recently did some troubleshooting on a ColdFusion server with an issue related to this necessary configuration step. Wil writes:

We ran into an issue when a company contacted us at CF Webtools because ColdFusion was suddenly no longer able to connect to their email providers mail servers. One day ColdFusion was sending emails to their clients just fine and the next day it was failing. As you know these issues are usually best resolved by asking "What changed?" As far as the client knew, nothing had changed - but we knew enough not to stop digging.

Read More
  • Share:

Side-by-side Configuration Error installing CF 11 on Win2008r2

Mark Kruger October 23, 2014 5:38 PM ColdFusion, Coldfusion Troubleshooting Comments (0)

One of my colleagues, Chris Tierney, was installing a pristine copy of ColdFusion 11 on a Windows 2008 server. He followed our standard protocol which is to install the server using the "built in" Web server, then create instances (we typically use multi-server mode) then use wsconfig.exe to connect the instances to IIS. It all went as planned until he tried to run wsconfig.exe (FYI - you must always run this as administrator). He got an error as follows:

java.io.IOException: Cannot run program "C:\Users\ADMINI~1.CFW\AppData\Local\Tem
p\2\\ExecuteAppCmd\ExecuteAppCmd.exe": CreateProcess error=14001, The applicatio
n has failed to start because its side-by-side configuration is incorrect.


Followed by an odd stack trace. After experimenting with permissions and googling he stumbled on Bug 3761543 in the ColdFusion bugbase. The issue is not very well documented. Apparently the MS C++ package installed on 08 is 32 bit. I'm not clear if we installed it or it shipped with 08, but remember, you need the MS C++ 64bit SP1 Redistributable. Here's the download link from Microsoft so you don't have to hunt it down.

The Fix

Microsoft Visual C++ 2008 SP1 Redistributable Package (x64)

One more time: This download fixes the "side-by-side configuration" when installing ColdFusion 11 on Windows 2008r2.

  • Share:

Business Referral - don't forget

Mark Kruger October 22, 2014 12:05 PM ColdFusion, Business Of Development Comments (0)

A week ago, in my post, The Muse Has Cash... I started a new program to reward community members for leads. Thank you for all the input and for the many leads generated already. We really appreciate it and we'll make you proud! After a quarter or so I will report on the success of the program.

Meanwhile, a few have pointed out that the previous post is lengthy so I wanted to put up the "express checkout" version. It's simple, if you refer a lead to us (email cfleads@cfwebtools.com) that results in new business, we will pay back to you 8% of the gross revenue from that customer in the first 10 months of working with the customer. If the customer spends 10k with us, you make $800.00. Simple and easy. So hook the Muse up. We are looking for another record year!

Note: In the past the Muse has offered bonuses for referring developers to us. This program is for new business, not developers - although as always if you are looking for work send me your resume. We typically hire several times a year.

  • Share:

Running ColdFusion 10 in Distributed Mode

Mark Kruger October 20, 2014 5:22 PM ColdFusion Comments (6)

A recent discussion on CF-Talk had a member trying to find instructions for setting up ColdFusion in "Distributed mode" on a CF 11 server. If you have never heard of "distributed mode" you are not alone among CF developers. It's not a common setup in my experience. Here's a quick 101. Many processes and daemons on a given server communicate using the TCP stack. TCP provides a predictable, high capacity, mature protocol for piping requests and data in and out of server processes. In this case, IIS or Apache communicate with CF through the local loopback (localhost or 127.0.0.1) IP address and a port - usually 8012 (or 8013 or 8014) chosen at installation. Naturally you can alter the IP address to which you are connecting, changing it from the loopback to... well any IP that's listening on 8012. That means you can set up your ColdFusion servers separately from your web servers. After all it's just IP networking. Why would you do that? The Muse will let his guest handle that question.

Meanwhile, to preempt (or perhaps spur) discussion, the Muse will note that this process is similar to something called "Reverse proxy" which functions in much the same way. The difference being with CF distributed, IIS on the front end handles all the "http stuff" and passes the request to CF just like it was a local engine, whereas with reverse proxy the HTTP request is simply redirected to the alternate server. That means the alternate server needs to be a full webserver plus application server. While that increases the overhead a bit, it has some advantages - but that's a topic for a different post.

Back to our CF-Talk question, it quickly became apparent that not many folks actually knew how to accomplish this task on a CF 10 (or 11) server due to the underlying platform switch to Tomcat. After some back and forth Byron Mann chimed in with some very specific instructions on how to get this done. Byron is a lead engineer at HostMySite - which makes the Muse feel better about their ColdFusion support. :) Here's his tutorial.

Read More
  • Share:

Can't Save applicationHost.config?

Mark Kruger October 8, 2014 5:24 PM Hosting and Networking Comments (1)

In an email group I am in there was a problem brought to the floor regarding removing the wildcard mapping from the applicationHost.config file in IIS 7.5. This file resides in the system32/inetsrv/config directory of your windows server and it contains the defaults for all sites. The defaults can be overridden using a web.config file in the root directory of an individual site. The user in question was trying to manually uninstall the connectors for ColdFusion 9. After going through all the steps there was one thing he could not seem to get rid of - a wildcard mapping for the jrun_iis6.dll in the handler mappings of IIS. He went down the list of things he had done and we all agreed that each file and step was complete - including removing the "global" mapping for this handler from applicationHost.config. While we were puzzling super guru and CFCelebrity Charlie Arehart (he of CF 411 fame) reminded us of a "gotcha" that occurs with files in the system32 directory and subdirectories.

The scoop is, if you open the file using a 32bit editor (say Notepad++) from system32/inetsrv/Config Windows does the old switcheroo and opens the identical (but unused) file in the SysWoW64/inetsrv/Config directory. You are editing the wrong file and you don't even know it (wow! ... or maybe I should say Wow64!). As an aside, this poorly named directory, SysWoW64, stands for "Windows on Windows 64 bit" - meaning files in this directory are "old 32 bit" windows files running on this "64 bit" version of windows. Not only is that unclear, it makes the continued use of system32 confusing. Why not just use system32 and system64? Ah well, I digress.

The Fix

The long and short of it is, to make sure you are editing the correct file, use notepad (the 64bit version ships with the OS). To avoid mistakes, open notepad first as Administrator, then navigate to and open the file in the /system32 directory. If you don't you will pull out your hair trying to figure out why your changes won't take. For more information check out this blog post on the issue by Mike Ratcliffe.

As always Muse readers thanks for you patronage. Especially thanks to those of you who have begun to pass referrals to folks who may need us - we are riding high because of you.

  • Share:

The Muse has Cash and He's Not Afraid to Use It!

Mark Kruger October 7, 2014 11:58 AM Business Of Development, Job Openings Comments (0)

The hardest thing about running a ColdFusion development shop is getting in front of the people who might need your help. Thousands of companies could use the expertise we offer but it can be very difficult to approach them. In spite of our culture, our transparency, our chameleon-like flexibility, our unique reputation, our high competency and our focus on communication and productivity, CTO's and CIO's tend to lump CF Webtools in with the outsourcing crowd. That's just not who we are. The truth is, once we gain the ear of someone who needs us we have an amazing record at closing the deal and retaining the customer. We alleviate the pitfalls of ColdFusion (oh yes, there are pitfalls) and allow the benefits to shine. We simply bring too much to the table to ignore.

So that's the Gordian knot the Muse has been trying to unravel for the last 18 months or so as we have doubled and tripled in size. How do I get the name and reputation of my fantastic company in front of the folks who need us? I mean, besides a holocaust cloak ("...Then why wasn't it listed among our assets?") what do we have to work with? My executive team and I have spent a few weeks mulling this over and we have concluded that perhaps our greatest asset is our connection with developers within the ColdFusion Community.

The truth is that when a developer who has developed for a decision maker recommends us to that individual he or she is far more likely to listen and take our pitch seriously. After all, finding good ColdFusion talent is difficult. In our experience it is referrals that seal the deal. We began thinking, both the Muse and the CF Webtools staff tends to be engaged in user groups, forums, lists, and events focused on ColdFusion. Instead of dedicating a big chunk of money to a marketing budget (of dubious return) we had an epiphany. Why spend money on promotions and ads when the connection we need is right in front of our cfnose. Let's pay our friends in the community for their referrals.

The Big Plan

So our big plan is simple, we are going to generously reward any developer who refers a company to us that subsequently becomes a customer. The rules are simple. First, you need to be a part of the ColdFusion developer community. We are not looking to line the pockets of recruiters. But if you are in IT and work with ColdFusion you are a candidate. Finally your lead must result in a sale for you to get paid. In short, for forwarding a name to us you could get a check in the mail - that's it! Read on for the nitty gritty details.

Read More
  • Share:

IIS Vulnerability Steals Payment Information (By Wil Genovese - CFG)

Mark Kruger March 6, 2014 2:35 PM ColdFusion, Coldfusion Security Comments (0)

Super guru Wil Genovese (Trunkful.com) is back to describe an IIS vulnerability that was inserted using a long-known (and patched) CF vulnerability. The Muse will make 2 points. First, if you are hit with this one call us! We will gladly put our shoulder to the wheel and help you dig out. Second, don't forget to patch your servers and keep up on the latest security news. No matter what your chosen platform you need to be vigilant and attentive. Take it away Wil.

First let me point out that the vulnerability that was found has a patch that has been available since January of 2013. So as the Muse said, patch your servers! I first read about this attack in a PC World article titled, PCWorld - Attackers exploited ColdFusion vulnerability to install Microsoft IIS malware. I spent hours reading all the linked websites and blog posts by the security researcher that discovered the IIS Malware (see this Trustwave post) trying in vain to learn the name of said DLL that gets installed, where it gets installed and how to detect the file(s). The few details I found were not completely useful. While I learned the behavior of the malware I never learned how to find the offending DLL or even the file name. I did discover that no existing anti-malware or anti-virus software would detect this rogue DLL. I repeated my futile search every few weeks to see if anything new was being reported.

Since knowing how to locate and expunge such things is part of my job I needed a way to find it, but how? I could search any of the servers at CF Webtools until the cows come home, but if none of them have been hit with this malware I will never find it. What I needed was a server that had been exploited to examine. Over the past year with the slightly larger than usual number of security holes discovered in ColdFusion we've had a few new clients come to us for help in patching and repairing servers. None of the IIS modules on those servers stood out to me as 'unusual', but I wasn't looking directly for this. Finally we had a company come to us for help with a breach.

Read More
  • Share: