ColdFusion Muse

Web Service SSL Issue: Trouble with Client Based Certificates

Fri, 27 Aug 2010 14:28:00 -0500

I was recently brought in at the 11th hour to an issue where a web service worked fine on an older 32 bit install of ColdFusion, but was not working on the new 64bit install. All the keystore certs were up to date and the client was scratching their collective heads. The web service in question used SSL and presented a client certificate. Now in order to do this in CF you have to manually construct your SOAP request and pass it as XML using CFHTTP. This is because only CFHTTP has an attribute for clientcert and clientcertpassword (as of CF 8 I believe).

In any case, the code our customer was using was straightforward. It assembled a soap request and then issued a call to CFHTTP like so: On the "old" Coldfusion 8 "standard" server this worked fine. But on the brand spanking new, freshly patched and upgraded ColdFusion 8 enterprise server it was failing.

The Issue

The problem here is that a vulnerability in TSL (that's "SSL version 3.1" - see my previous post to learn more about the various SSL versions) was discovered in fall of 2009. This vulnerability allowed a "man in the middle" attacker to force a "renegotiation" of the handshake - thus allowing the insertion of arbitrary code into the request. Obviously this is a serious flaw. The fix was for vendors to simply disable the renegotiation feature in their products. So, for example, IIS 7 does not allow renegotiation by default.

So why is this issue not out there in the CF blogging world yet? First, I think that the use of client certs is a fairly small universe of ColdFusion applications. Second, Sun followed suit and fixed this issue with version 1.6.0_19 by disabling renegotiation. I think that many CF Servers are still using 1.6.0_18b or below - so this issue has yet to really rear its ugly head.

In any case, regular SSL requests continue to work as always with renegotiations disabled. A client certificate driven request is different however. It often requires renegotiation because of the complexity of the handshake (with 2 certificate pairs involved. That means client certificate driven CFHTTP SSL requests using the 1.6.0_19+ JVM will often fail to successfully negotiate a secure session. I want to say they will probably or certainly fail, but I'm not positive on that score.

The Fix - Such as it is

You have two ways of fixing this. You can roll back to 1.6.0_18. Seeing as how the current build is _20 you may not want to do this. Or, if you want to stay on 1.6.0_19+ you can add the following argument to your JVM.config file or files. -Dsun.security.ssl.allowUnsafeRenegotiation=true Obviously this allows for the server to renegotiate successfully. Your JVM will be vulnerable to the TLS exploit, but depending on your situation it may be a fairly low risk proposition. Still, you should take it into account. Consider running a separate JVM instance just for your web service. Some edge security devices can sniff out this issue as well.

Many thanks to my good friend and troubleshooting colleague Vlad Friedman from the Edge Web for figuring this out. I would also recommend that your read Chris Mahns blog entry on TLS Remediation.

Win2003 64 Bit Install Problems

Wed, 18 Aug 2010 19:43:00 -0500

This is a follow up to my post titled 64bit on Windows 2k3 Web Edition. In that post I did a play by play of an issue trying to install 64 bit ColdFusion 8 Enterprise on a Windows 2003 "Web Edition" platform. I have just finished a troubleshooting session with a nearly similar issue on Windows 2003 "Data Center" edition. If you have this problem you will know it because the install will silently fail after the files are extracted. Check in your temp directory and you will see a cryptic folder beginning with "I" containing two folders "windows" and "installdata". These 2 folders contain the extracted install files. Inside the "windows" folder you will also see an hotspot error log. It looks like "hs_err_pidXXX.log". You may have seen such files in your ColdFusion8/runtime/bin directory. They occur when the hot spot compiler has an unhandled exception.

Under the hood the ColdFusion install is firing off the "adobe_cf.exe" from that same windows folder. This exe file uses the adobe_cf.lax file as a launch settings file. Taking a closer look at the lax file and you will see some Java settings including two important settings. One is lax.nl.current.vm and the is lax.installer.win32.internal.property.0. Both of these settings point to a Java.exe file. By default the Java.exe file it points to is contained in that other temp folder called 'installerdata'. My guess is that the reason that the ColdFusion fails because the 64 bit JVM in the /installerdata folder is not compatible with something in the windows installation. In particular I think that there is a missing 64bit class or object.

The Fix

The fix is as follows.

Download and install the 32 bit 1.6 JDK.
Edit the adobe_cf.lax file to point to the java.exe file inside the jre folder of the newly installed 32 bit JDK.
Run the Adobe_cf.exe file.

The install should fire up at the point of the first splash screen and follow through to completion. To be clear - you are still installing the 64 bit version of ColdFusion. Only the "launch anywhere" process will be running 32 bit.

MS Throws a Curve: IE 8 and the New Security Message

Mon, 19 Apr 2010 22:00:00 -0500

You have probably seen the special security warning that appears when a page has "a mix" of secure and not secure resources. I recently ran into a usability issue with regard to this message that I thought deserved a quick post on the Muse. Let's start with an example:

[More]

Another SQLi Attack: Urchin.js

Fri, 16 Apr 2010 14:11:00 -0500

I spent yesterday cleaning and inoculating another server infected with SQL Injection. Unless you have been living in a cave you know that SQL injection (SQLi) is the most common vulnerability of web based application. This is due to 2 factors - 1) almost all databases use numeric fields and B) web applications by nature pass user input into queries. Of course I could throw in there that web developers are often lax about inoculating their code. There is also the problem of legacy code - code that has been around since the dark ages of the late 90's. Of course SQLi has been around that long as well, but it is surprising how much legacy code chugs along for a decade or more with no problem in spite of the vulnerability.

Anyway, here's the skinny on the latest attack I found. It uses our old friend "Cast" in conjunction with the char() function of MS SQL. Note, this is not a new attack on the web - it's only new to me in that I've never battled this particular attack before.

[More]

Troubleshooting and Optimizing Solr on ColdFusion 9

Sun, 04 Apr 2010 20:53:00 -0500

I had an interesting troubleshooting session recently with a customer. This customer had a very high powered server - SAS drives, 16 gigs of RAM, 64 bit throughout, Coldfusion 9 and an 8 gig Java Heap. The site had 70 or 80 search collections and they had switched to CF9 specifically to get beyond the limitations of Verity. Everything was performing well when suddenly the search service stopped responding to requests and simply started throwing "collection not found" errors. Coldfusion seemed fine and dandy. It continued to be responsive and it had no hanging threads. It was as if the search service had lost it's handles to the various collections. Restarting Solr solved the issue, but why was Solr locking up?

[More]

Muse Reviews the Oscars

Mon, 08 Mar 2010 10:28:00 -0500

The Muse is a geek to be sure but he's also eclectic in the breadth of his knowledge. In between banter about object instantiation and thread management I manage to go to the movies with my wife and kids. I even read a book now and then. My 19 year old daughter Jasmine forces me to stay up on enough entertainment news so I can have more interesting conversations with her at Sunday Lunch. So naturally I was interested in the Oscars. I did indeed watch the whole thing with my wife (actually I watched while I continued my reading of the 19th edition of the "Complete PC Repair and Upgrade Guide"... but it still counts). Here is the Muse review of the 82nd annual Oscars:

[More]

The Muse Visits EdgeWeb Hosting

Sat, 06 Mar 2010 16:51:00 -0500

On Monday and Tuesday of this week I was privilege to spend some time in Baltimore Maryland at the downtown location of EdgeWeb Hosting (EWH) - a hosting and data center services company owned and managed by Vlad Friedman. EWH specializes in ColdFusion hosting (although they have many other services by now). I've known Vlad for years through some mutual customers and through an email list on which we are both active participants, but I had never met him in person. Since I was doing some "emergency consulting" for a mutual customer I needed spend a day or two on site at EWH. Vlad was kind enough to show me around his data center and give me the "inside scoop" on the data center business.

The EdgeWeb data center is in a massive facility in the heart of Baltimore. EWH has redundant everything - including redundant power from separate substations, 4 way redundant UPS, and impressive cooling. The entire infrastructure has been recently designed from the ground up with the care and planning of a master craftsman. Vlad is understandably proud of the center and the staff he has assembled. I don't remember all the things he showed me but his networking topology uses the latest and greatest adaptive routing and his security setup (intrusion detection, audit control and the like) is state-of-the-art. I have visited a fair number of data centers but I was really impressed.

I was able to meet some of the EWH staff as well. His DBA and I spent some time gabbing about the differences between MSSQL 05 and MSSQL 08. His operations director is one of those IT pros who know exactly the questions that need asking. But I already knew that EWH has good staff. We have worked with his hosting support staff for years. We have a number of high profile customers hosted at EWH and we have always given the support staff high marks for their knowledge, practical know-how and alacrity. There is a reason they are often voted best in class for hosting and data center services.

On Tuesday evening Vlad took me to G & M restaurant for the best crab cakes I've ever had (and I am a crab cake lover). We had a great time telling our stories and filling up on crab and shrimp cocktail. As I told Vlad, it was the best meal I've had in many months - and of course a geek like the Muse thrives on conversations about hacking, retro computers, security vulnerabilities, and the business of IT. As is often the case when I meet someone who has built a thriving business I was able to glean many pearls of practical wisdom and advice that I hope will serve me well.

So here's a big thanks to Vlad and to EWH as well as a hearty recommendation. I hope they have a long run at the top of the hosting food chain.

ColdFusion 8.01 64 bit on Windows 2k3 Web Edition - The Silent Killer

Wed, 24 Feb 2010 14:49:00 -0500

This post is a rundown of a recent troubleshooting adventure (If you don't know what a rundown is, ask Charles). I write these little post-mortems for a couple reasons. For one thing, I will need this solution (or some part of it) again at some point and my little pea brain is not going to retain all of this information. But what I usually do retain is the knowledge that somewhere on my blog I have a post about an issue with a Win2k3 64 bit CF install - or as Tevye would say, "Somewhere in the good book it must say something about a chicken!" The other reason is to benefit those of you in the ColdFusion universe who may be struggling with this issue. The Muse is all about community. If you are battling an install where the installer is failing silently after the splash screen, then this post will likely be a valuable read for you. If it doesn't solve your problem send me a note via Ask-A-Muse and I'll see if I can think of anything else you might try.

I was tasked with installing and optimizing ColdFusion 8 Enterprise 64 bit on a new server for a customer. I do this kind of task pretty often for companies who wish to have a clean and fully optimized install for migration. The new server was running Windows 2003 64 bit "Web Edition". Previously (in Windows 2000 I believe) the Web Edition would only support 2 Gigs of memory. But 2003 server supports up to 8 Gigs. I wanted to use 64 bit because the server was going to manage a large pool of modestly trafficked sites. It really didn't need the full fledged "multi-server" install. It just needed a nice big heap size. For that purpose the standalone Jrun install is perfect. In short order however, I found myself pitted against Win2k3 in a no holds barred install death match. Here's my story.

[More]

Cfobjectcache Docs Wrong? Inconceivable!

Wed, 17 Feb 2010 18:51:00 -0500

In this post I'm going to claim that part of the official documentation is wrong. Whenever I do this sort of thing I always think of the movie "The Princess Bride" when Enigo says "You kep using that word... I do na think it means what you think it means". Be that as it may, I think the docs in this case are ambiguous at best and at worse downright misleading. There's an obscure little tag called cfobjectcache that's available in ColdFusion server. Although it was a part of ColdFusion 5, I first became aware of this tag in Cf 8. You can find Adobe's documentation for the tag here. If you read the documentation (always a good idea - the muse is great but he doesn't write about everything) you may get the wrong idea about this tag. At the top of the documentation it says (and I quote), "Description: Flushes query cache". Well that's straightforward enough isn't it? This tag is designed to flush the cache of queries on the server. It's easy to use: ...poof - your query cache is back to square one. Well not so fast my friend...

[More]

Multi-Monitor Tip

Tue, 16 Feb 2010 18:16:00 -0500

For those of you using more than one monitor and using windows 7, I just accidentally discovered something that is pretty cool. Select a window on one of your screens. Hold down the windows key and the shift key and then use the right or left arrow keys to move it between your various monitors. That's something I do all day long - move various windows between my three monitors to make space for one thing or another. I suppose it's not new to some of you out there - but I thought it was nifty :)

Migrating XP Pro 32bit to Windows 7 Pro 64 Bit

Thu, 11 Feb 2010 12:55:00 -0500

This post is about the ins and outs of moving from XP Pro 32 bit to Windows 7 64 Bit. I just completed such a move and I have some tips for you that might save you hours of frustration. But before we begin let's get a couple things straight. First, this is not a post about the assets or shortcomings of Microsoft or it's products. Nor is this a forum for you Apple users to tell us all how superior you are because your box is shinier than ours. I actually love Apple products, but Apple users have been known to turn red and swell up like giant angry strawberries if you say anything positive about Microsoft. So if you are one of those folks who is going to have a stroke reading about someone actually choosing a Microsoft product, please stop reading now - or at least have emergency personnel standing by. On a side note, my next hardware project is building an Apple from an Intel box and off the shelf parts - same OS, less than half the cost. I'll write an article on that and hopefully sooth my Apple readers ruffled feathers (it probably won't be shiny though).

Meanwhile, let me first say that I was sad to see my XP pro box go. A computer is more than an OS to those of us in IT. We spend a lot of time and effort making it do things that "regular users" don't have to think about. My desktop XP Pro PC had more than 100 programs installed on it. Many of them I used regularly. I fully expected to have to reinstall numerous programs to insure full functionality. I also expected to have to abandon some items that would no longer work in my new environment. A year and a half ago I moved from one XP box to another using LapLink's PC Mover and it worked splendidly. This time, however, I was nervous about using PC Mover for 3 reasons:

I was moving from XP Pro 32 bit up 2 versions to Windows 7 64 bit (skipping Vista altogether).
My XP box had Office 2003 on it and I was putting Office 2007 in the new OS without an upgrade, yet I still wanted my outlook settings and email to migrate properly.
I was moving my login profile from a local account to a domain account.

I naturally assumed that I would have a great deal of work to do just to get the machine back to the functional state from which it started. Even with my reservations the LapLink docs seemed to indicate it was possible and could be successful so I decided to use the product anyway. Here is my story.

[More]

The Boolean-O-Matic: ColdFusion's Weird Relationship With Truth

Fri, 05 Feb 2010 12:28:00 -0500

Hello muse readers. I apologize for my long hiatus (which means a stretch of time where I was absent - it's not a size joke). I have been swamped with closing out the old year and implementing plans for the new year. I'm afraid our little chats were put on the back burner temporarily. However, now that new year has begun I am committed to continuing our friendship. I'd like to start out with something simple. Indeed, some of you may find this to be ColdFusion 101.

This post is going to discuss Boolean values. A Boolean is one of those datatypes more defined by how it is evaluated than by what it contains. The muse definition is that if something can return a "true" or "false" in the context of a logic statement (cfif) it is a Boolean. It may be other things as well, but it has the properties of a boolean and returns one of 2 states - true or false. Interestingly, every language handles Booleans differently and many of them use the same wild west sort of approach that ColdFusion uses - where several things can be used as Booleans.

Even if you don't know it, you use Booleans every time you create a cfif statement. Still, it's surprising how many advanced developers do not fully grasp all the ways that ColdFusion has of evaluating something as True or False. And having said that I am fully aware that some smarty-pants developer will immediately inform me of some new way I haven't seen before of evaluating true or false (thank you sir, may I have another).

Anyway, I'd like to take a little journey into the world of Booleans to start off my 2010 blogging. Note: this post has a number of neat "tips and tricks" that you may have not seen before. Whether you choose to use them can depend greatly on your environment, the structure of your code and the standard you are using (especially in a team environment). I'm not advocating for or against, although I have my own preferences. I'm only putting it out there as another arrow in your quiver. So with that caveat taken care of, let's begin.

[More]

Blizzard Day 2

Wed, 09 Dec 2009 15:10:00 -0500

Well only the brave soul (other than me) made it to the office today. That would be hardy stalwart and compadre Guy Rish. Everyone else is working from home. The final tally looks like 12 to 14 inches and the drive in was pretty daunting. Here are some photos of the final damage.

Here's what it looked like at the office driveway.

Near my local Starbucks

The parking lot.

My back and arms are killing me from shoveling (and I even had my 2 teenage sons to help - yikes I'm getting old).

Blizzard Day in Omaha

Tue, 08 Dec 2009 13:39:00 -0500

Every time someone hears I'm from Nebraska they ask about the cold and snow - followed by corn, cows, "do you have a Gap" and "how long before you get electricity and indoor plumbing". As I've documented here and elsewhere Omaha is a high tech thriving economy. Although I live within a few hundred feet of a corn field, I also live within a few miles of excellent shopping, theatre, music and the arts. Still, it actually does get cold and snowy in Nebraska. We are in the middle of a blizzard today.

9:00 a.m.

Here's what it looked like outside my office door at 9:00 this morning.

11:00 a.m.

And here's the progress after about 2 hours.

I'll post another update when it gets deeper. :)

Work for the Muse: Dec 09

Wed, 02 Dec 2009 17:53:00 -0500

I know there are those of you out there who are simply dying to come work for me. Here is your big chance. If you feel like you have what it takes to join our crack development team drop me your resume at jobs@cfwebtools.com. This is a full time position on site in Omaha NE (America's best kept secret). CF Webtools offers excellent pay and benefits and a great work environment. If you think you have what it takes, here is the job description. If you a recruiter please don't call or send emails (please... I'm begging you).

CF Webtools is seeking a full-time, experienced Flex Developer. The candidate must be proficient in Flex 2.0 and also familiar with calling ColdFusion CFC's, the Cairngorm framework, Linux and Apache are HUGE pluses. This person needs to be able to work at the highest technical level of all phases of application analysis and design.

JOB REQUIREMENTS

2-3 years experience with Flex 2.0
An eye for designing appealing pages that seamlessly integrates with the rest of the product.
Experience with MSSQL, MySQL or Oracle.
Bachelor's Degree or equivalent work experience
Understanding of and experience with UI architectures (e.g. Cairngorm)
Self motivated and manage own time/work
Excellent work ethic and a team player.
Comfortable multitasking, resolving competing priorities, and meeting project deadlines.
Excellent interpersonal communication skills and of exceptional character.
Decisive, action-oriented individual who learns quickly, works independently, and creates solutions.
Must be authorized to work in the United States on a full-time basis for any employer.

Wish List

Experience with Flex 3.0
Experience with ColdFusion a HUGE plus
Experience with Linux
Experience with Java or Flash
Experience with financial data is a bonus