/
README.htm
181 lines (147 loc) · 12.3 KB
/
README.htm
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>README: Unofficial Updater 2</title>
<style type="text/css">
/*
Copyright (c) 2010, Yahoo! Inc. All rights reserved.
Code licensed under the BSD License:
http://developer.yahoo.com/yui/license.html
version: 3.3.0
build: 3167
*/
h1{font-size:138.5%;}h2{font-size:123.1%;}h3{font-size:108%;}h1,h2,h3{margin:1em 0;}h1,h2,h3,h4,h5,h6,strong{font-weight:bold;}abbr,acronym{border-bottom:1px dotted #000;cursor:help;}em{font-style:italic;}blockquote,ul,ol,dl{margin:1em;}ol,ul,dl{margin-left:2em;}ol li{list-style:decimal outside;}ul li{list-style:disc outside;}dl dd{margin-left:1em;}th,td{border:1px solid #000;padding:.5em;}th{font-weight:bold;text-align:center;}caption{margin-bottom:.5em;text-align:center;}p,fieldset,table,pre{margin-bottom:1em;}input[type=text],input[type=password],textarea{width:12.25em;*width:11.9em;}
</style>
</head>
<body>
<h1>Unofficial Updater 2</h1>
<h2>Introduction</h2>
<p>Unofficial Updater 2 (UU2) is an outgrowth of the frustration that came from
trying to manually patch Adobe ColdFusion 8.0.1 with the numerous hot fixes
and security bulletins that have been published. It is a tool to provide
an easy way of consistently applying applicable hot fixes and security
bulletins to Adobe ColdFusion 8.0.1, 9.0.1, or 9.0.2.</p>
<h3>Disclaimers</h3>
<ol>
<li>Use of Unofficial Updater 2 is <strong>at your own risk</strong>
<ul><li><strong>Do not</strong> run Unofficial Updater 2 for the first time on a production system</li></ul></li>
<li>Unofficial Updater 2 is <strong>not endorsed by or have any ties</strong> to Adobe</li>
<li>ColdFusion Server/process <strong>should not be running</strong> when you use Unofficial Updater 2</li>
<li>Unofficial Updater 2 can <strong>only be run against</strong> Adobe ColdFusion <strong>8.0.1</strong>, <strong>9.0.1</strong>, or <strong>9.0.2</strong>
<ul><li>If you are running <strong>8.0.0</strong> or <strong>9.0.0</strong> you need to apply Update 1 from Adobe first
<ul><li><a href="http://kb2.adobe.com/cps/403/kb403277.html">Adobe ColdFusion 8 Update 1</a></li>
<li><a href="http://kb2.adobe.com/cps/849/cpsid_84973.html">Adobe ColdFusion 9 Update 1</a></li></ul></li></ul></li>
<li>Unofficial Updater 2 is <strong>updated</strong> whenever Adobe releases a new (or changes) a hot fix or security bulletin
<ul><li>Matrix of published hot fixes and security bulletins
<ul><li><a href="https://github.com/dcepler/unofficial-updater2/blob/master/cf801-hotfix-matrix.pdf?raw=true">Hot Fix Matrix: ColdFusion 8.0.1</a></li>
<li><a href="https://github.com/dcepler/unofficial-updater2/blob/master/cf901-hotfix-matrix.pdf?raw=true">Hot Fix Matrix: ColdFusion 9.0.1</a></li>
<li><a href="https://github.com/dcepler/unofficial-updater2/blob/master/cf902-hotfix-matrix.pdf?raw=true">Hot Fix Matrix: ColdFusion 9.0.2</a></li></ul></li></ul></li>
<li>Unofficial Updater 2 will <strong>need to be downloaded and run again</strong> when it is updated to apply all new (or changed) hot fix or security bulletin from Adobe</li>
<li>Unofficial Updater 2 works <strong>in most</strong> situations/installs, but if you have something non-standard it might not work
<ul><li>Consider contacting a <a href="http://www.cf411.com/cfconsult">CF-oriented Troubleshooting Consultant</a> to ensure you are properly patched</li></ul></li>
</ol>
<h2>What it does</h2>
<p>First time you run Unofficial Updater 2, it will download <strong>ALL</strong> hotfixes and
security bulletins from Adobe for both ColdFusion 8.0.1, 9.0.1, and 9.0.2. UU2 will
create <strong>Unofficial-Updater2-with-downloads.jar</strong> which contains the
downloaded hotfixes and security bulletins. This is done since UU2
can not directly package the updates and will make it easier to patch
additional servers without the need of an Internet connection.</p>
<p>Once the downloading is complete, UU2 will asks specific questions about how
Adobe ColdFusion is installed. It will then produce backups of any directories
it will modify. Finally, it will apply the hotfixes and security bulletins
according to the published instructions.</p>
<p>UU2 only updates files, it <strong>does not modify</strong> any settings in ColdFusion
such as <em>neo-</em><em>*.xml</em> or <em>jvm.config</em>.</p>
<p>A list of files that Unofficial Updater 2 updates as compared to a clean
install of Adobe ColdFusion 8.0.1, 9.0.1, and 9.0.2 are listed below:</p>
<ul>
<li><a href="https://raw.github.com/dcepler/unofficial-updater2/master/uu2-cf801-standalone-filechanges.txt">File Changes: ColdFusion 8.0.1 Standalone</a></li>
<li><a href="https://raw.github.com/dcepler/unofficial-updater2/master/uu2-cf801-jrun-filechanges.txt">File Changes: ColdFusion 8.0.1 Multi-Server JRun4</a></li>
<li><a href="https://raw.github.com/dcepler/unofficial-updater2/master/uu2-cf801-j2ee-filechanges.txt">File Changes: ColdFusion 8.0.1 J2EE</a></li>
<li><a href="https://raw.github.com/dcepler/unofficial-updater2/master/uu2-cf901-standalone-filechanges.txt">File Changes: ColdFusion 9.0.1 Standalone</a></li>
<li><a href="https://raw.github.com/dcepler/unofficial-updater2/master/uu2-cf901-jrun-filechanges.txt">File Changes: ColdFusion 9.0.1 Multi-Server JRun4</a></li>
<li><a href="https://raw.github.com/dcepler/unofficial-updater2/master/uu2-cf901-j2ee-filechanges.txt">File Changes: ColdFusion 9.0.1 J2EE</a></li>
<li><a href="https://raw.github.com/dcepler/unofficial-updater2/master/uu2-cf902-standalone-filechanges.txt">File Changes: ColdFusion 9.0.2 Standalone</a></li>
<li><a href="https://raw.github.com/dcepler/unofficial-updater2/master/uu2-cf902-jrun-filechanges.txt">File Changes: ColdFusion 9.0.2 Multi-Server JRun4</a></li>
<li><a href="https://raw.github.com/dcepler/unofficial-updater2/master/uu2-cf902-j2ee-filechanges.txt">File Changes: ColdFusion 9.0.2 J2EE</a></li>
</ul>
<p>If you have modified files in <strong>CFIDE</strong> and/or <strong>WEB-INF</strong> they could be changed due to files contained in the updates from Adobe.</p>
<h2>How to use</h2>
<ol>
<li><a href="https://github.com/downloads/dcepler/unofficial-updater2/Unofficial-Updater2.jar">Download</a> the packaged JAR installer</li>
<li>Stop the ColdFusion Server/process you are going to update</li>
<li>Depending upon your system you might be able to double-click <strong>Unofficial-Updater2.jar</strong> to run it, otherwise it will need to be run from command line
<ul><li>On Windows might need to <strong>Run as Administrator</strong> for GUI or opening command prompt</li>
<li><strong>Installer</strong> (auto-detect GUI or text)
<ul><li><code>java -jar Unofficial-Updater2.jar</code></li></ul></li>
<li><strong>Force GUI Installer</strong>
<ul><li><code>java -jar Unofficial-Updater2.jar swing</code></li></ul></li>
<li><strong>Force Text Installer</strong>
<ul><li><code>java -jar Unofficial-Updater2.jar text</code></li></ul></li>
<li><strong>Text Installer run as cfusion user on Linux/UNIX</strong>
<ul><li><code>su -s /bin/sh "cfusion" -c "java -jar Unofficial-Updater2.jar text"</code></li></ul></li>
<li><strong>Text Installer run as root on Linux/UNIX</strong>
<ul><li><code>sudo java -jar Unofficial-Updater2.jar text</code></li></ul></li>
<li>Once <em>Unofficial-Updater2-with-downloads.jar</em> is created, you can use that instead of <em>Unofficial-Updater2.jar</em></li></ul></li>
<li>Walk through the screens putting the appropriate information
<ul><li><strong>Be sure to fill the directory locations correctly</strong>, Unofficial Updater 2 will try to validate they are correct before letting you proceed to the next step</li></ul></li>
<li>Finish updater by pressing <strong>Apply Updates</strong></li>
<li>On OS X/Linux/UNIX verify (and possibly correct) ownership and permission of the files updated</li>
</ol>
<p>Please see the <a href="https://github.com/dcepler/unofficial-updater2/wiki/Using-Unofficial-Updater-2">Wiki: Using Updater 2</a> for screenshots and walkthrough.</p>
<h2>Backups</h2>
<p>Unofficial Updater 2 creates backups of the directories that are modified, but it is <strong>HIGHLY</strong> recommended that you
create your own backups of your ColdFusion installation to restore from in case of a problem. The backups created by UU2
are stored in the directory specified when running UU2 and are named <strong>{directory-name}-uu2-{datetime-stamp}.zip</strong></p>
<h2>Details</h2>
<p>At the core, Unofficial Updater 2 is just an <a href="http://ant.apache.org/">Apache Ant</a> script. Ant was chosen
since it could provide cross platform support. The ant script was
wrapped with <a href="http://antinstaller.sourceforge.net/">Ant Installer</a> to create a GUI and text based interface which
only require Java 1.5+ to be installed. </p>
<h3>ColdFusion 8.0.1</h3>
<p>All hot fixes and security bulletins published as of September 19, 2012 for
ColdFusion 8.0.1 are applied except if they were superseded by a newer
patch and the following:</p>
<ul>
<li><a href="http://kb2.adobe.com/cps/404/kb404026.html">kb404026 - Patch for Performance Monitor with ColdFusion 8.0.1</a></li>
<li><a href="http://www.adobe.com/support/security/bulletins/apsb09-12.html">CVE-2009-1876 - wsconfig.jar update for Apache</a></li>
<li><a href="http://kb2.adobe.com/cps/403/kb403750.html">kb403750 - Using the flexgateway to instantiate multiple instances of CFCs causes objects to be populated as nulls (hf801-71643)</a></li>
</ul>
<p>Both <strong>kb404026</strong> and <strong>CVE-2009-1876</strong> require modifications to be done to the
system configuration. <strong>kb404026</strong> requires ability to modify the Windows
registry and <strong>CVE-2009-1876</strong> will modify the connector configuration.
<strong>kb403750</strong> is not installed since it does not seem to resolve all the issues
and <a href="http://www.mischefamily.com/nathan/index.cfm/2009/10/1/hf80171643-Breaks-Application-Specific-Custom-Tag-Paths">breaks other things</a>.</p>
<h3>ColdFusion 9.0.1</h3>
<p>All hot fixes and security bulletins published as of September 19, 2012 for
ColdFusion 9.0.1 are applied except if they were superseded by a newer
patch.</p>
<h3>ColdFusion 9.0.2</h3>
<p>All hot fixes and security bulletins published as of September 19, 2012 for
ColdFusion 9.0.2 are applied except if they were superseded by a newer
patch.</p>
<h3>Additional Notes</h3>
<p>Please refer to the various technotes about changes to configuration options
since Unofficial Updater 2 only updates files, it <strong>does not modify</strong> any
settings in ColdFusion such as <em>neo-</em><em>*.xml</em> or <em>jvm.config</em>.</p>
<ul>
<li><a href="http://www.adobe.com/support/security/bulletins/apsb11-04.html">APSB11-04 - Security update: Hotfix available for ColdFusion</a></li>
<li><a href="http://www.adobe.com/support/security/bulletins/apsb11-14.html">APSB11-14 - Security update: Hotfix available for ColdFusion</a></li>
<li><a href="http://www.adobe.com/support/security/bulletins/apsb11-29.html">APSB11-29 - Security update: Hotfix available for ColdFusion</a></li>
<li><a href="http://www.adobe.com/support/security/bulletins/apsb12-06.html">APSB12-06 - Security update: Hotfix available for ColdFusion</a></li>
<li><a href="http://www.adobe.com/support/security/bulletins/apsb12-15.html">APSB12-15 - Security update: Hotfix available for ColdFusion 9.0.1 and earlier</a></li>
<li><a href="http://www.adobe.com/support/security/bulletins/apsb12-21.html">APSB12-21 - Security update: Hotfix available for ColdFusion 10 and earlier</a></li>
<li>Additional Information
<ul><li><a href="http://www.cutterscrossing.com/index.cfm/2012/3/27/ColdFusion-Security-Hotfix-and-Big-Forms">ColdFusion Security Hotfix APSB12-06 and Big Forms</a></li></ul></li>
</ul>
<p>Also it is highly recommended to update the underlying JVM that ColdFusion
uses to 1.6.0 Update 24 for ColdFusion 8.0.1 and 9.0.1</p>
<ul>
<li><a href="http://kb2.adobe.com/cps/894/cpsid_89440.html">Oracle Security Alert CVE-2010-4476 | ColdFusion</a></li>
<li>Additional Information
<ul><li><a href="http://www.carehart.org/blog/client/index.cfm/2011/10/28/CF911-Have-you-updated-your-ColdFusion-JVM-to-24-yet-Important-security-fix-for-CF-89">CF911: Have you updated your #ColdFusion JVM to _24 yet? Important security fix for CF 8/9</a></li>
<li><a href="http://blog.kdecherf.com/2012/04/12/oracle-i-download-your-jdk-by-eating-magic-cookies/">Oracle, I download your JDK by eating magic cookies</a></li></ul></li>
</ul>
</body>
</html>