Skip to content

Commit

Permalink
apply apsb12-21, support for cf9.0.2
Browse files Browse the repository at this point in the history
  • Loading branch information
@dcepler
dcepler committed Sep 19, 2012
1 parent 629c39e commit 4559054
Show file tree
Hide file tree
Showing 17 changed files with 228 additions and 97 deletions.
40 changes: 26 additions & 14 deletions README.htm
View file
Expand Up @@ -16,7 +16,6 @@
</head>

<body>

<h1>Unofficial Updater 2</h1>

<h2>Introduction</h2>
Expand All @@ -25,7 +24,7 @@ <h2>Introduction</h2>
trying to manually patch Adobe ColdFusion 8.0.1 with the numerous hot fixes
and security bulletins that have been published. It is a tool to provide
an easy way of consistently applying applicable hot fixes and security
bulletins to Adobe ColdFusion 8.0.1 or 9.0.1.</p>
bulletins to Adobe ColdFusion 8.0.1, 9.0.1, or 9.0.2.</p>

<h3>Disclaimers</h3>

Expand All @@ -34,21 +33,24 @@ <h3>Disclaimers</h3>
<ul><li><strong>Do not</strong> run Unofficial Updater 2 for the first time on a production system</li></ul></li>
<li>Unofficial Updater 2 is <strong>not endorsed by or have any ties</strong> to Adobe</li>
<li>ColdFusion Server/process <strong>should not be running</strong> when you use Unofficial Updater 2</li>
<li>Unofficial Updater 2 can <strong>only be run against</strong> Adobe ColdFusion <strong>8.0.1</strong> or <strong>9.0.1</strong>
<li>Unofficial Updater 2 can <strong>only be run against</strong> Adobe ColdFusion <strong>8.0.1</strong>, <strong>9.0.1</strong>, or <strong>9.0.2</strong>
<ul><li>If you are running <strong>8.0.0</strong> or <strong>9.0.0</strong> you need to apply Update 1 from Adobe first
<ul><li><a href="http://kb2.adobe.com/cps/403/kb403277.html">Adobe ColdFusion 8 Update 1</a></li>
<li><a href="http://kb2.adobe.com/cps/849/cpsid_84973.html">Adobe ColdFusion 9 Update 1</a></li></ul></li></ul></li>
<li>Unofficial Updater 2 is <strong>updated</strong> whenever Adobe releases a new (or changes) a hot fix or security bulletin
<ul><li>Matrix of published hot fixes and security bulletins
<ul><li><a href="https://github.com/dcepler/unofficial-updater2/blob/master/cf801-hotfix-matrix.pdf?raw=true">Hot Fix Matrix: ColdFusion 8.0.1</a></li>
<li><a href="https://github.com/dcepler/unofficial-updater2/blob/master/cf901-hotfix-matrix.pdf?raw=true">Hot Fix Matrix: ColdFusion 9.0.1</a> </li></ul></li></ul></li>
<li><a href="https://github.com/dcepler/unofficial-updater2/blob/master/cf901-hotfix-matrix.pdf?raw=true">Hot Fix Matrix: ColdFusion 9.0.1</a></li>
<li><a href="https://github.com/dcepler/unofficial-updater2/blob/master/cf902-hotfix-matrix.pdf?raw=true">Hot Fix Matrix: ColdFusion 9.0.2</a></li></ul></li></ul></li>
<li>Unofficial Updater 2 will <strong>need to be downloaded and run again</strong> when it is updated to apply all new (or changed) hot fix or security bulletin from Adobe</li>
<li>Unofficial Updater 2 works <strong>in most</strong> situations/installs, but if you have something non-standard it might not work
<ul><li>Consider contacting a <a href="http://www.cf411.com/cfconsult">CF-oriented Troubleshooting Consultant</a> to ensure you are properly patched</li></ul></li>
</ol>

<h2>What it does</h2>

<p>First time you run Unofficial Updater 2, it will download <strong>ALL</strong> hotfixes and
security bulletins from Adobe for both ColdFusion 8.0.1 and 9.0.1. UU2 will
security bulletins from Adobe for both ColdFusion 8.0.1, 9.0.1, and 9.0.2. UU2 will
create <strong>Unofficial-Updater2-with-downloads.jar</strong> which contains the
downloaded hotfixes and security bulletins. This is done since UU2
can not directly package the updates and will make it easier to patch
Expand All @@ -63,7 +65,7 @@ <h2>What it does</h2>
such as <em>neo-</em><em>*.xml</em> or <em>jvm.config</em>.</p>

<p>A list of files that Unofficial Updater 2 updates as compared to a clean
install of Adobe ColdFusion 8.0.1 or 9.0.1 are listed below:</p>
install of Adobe ColdFusion 8.0.1, 9.0.1, and 9.0.2 are listed below:</p>

<ul>
<li><a href="https://raw.github.com/dcepler/unofficial-updater2/master/uu2-cf801-standalone-filechanges.txt">File Changes: ColdFusion 8.0.1 Standalone</a></li>
Expand All @@ -72,6 +74,9 @@ <h2>What it does</h2>
<li><a href="https://raw.github.com/dcepler/unofficial-updater2/master/uu2-cf901-standalone-filechanges.txt">File Changes: ColdFusion 9.0.1 Standalone</a></li>
<li><a href="https://raw.github.com/dcepler/unofficial-updater2/master/uu2-cf901-jrun-filechanges.txt">File Changes: ColdFusion 9.0.1 Multi-Server JRun4</a></li>
<li><a href="https://raw.github.com/dcepler/unofficial-updater2/master/uu2-cf901-j2ee-filechanges.txt">File Changes: ColdFusion 9.0.1 J2EE</a></li>
<li><a href="https://raw.github.com/dcepler/unofficial-updater2/master/uu2-cf902-standalone-filechanges.txt">File Changes: ColdFusion 9.0.2 Standalone</a></li>
<li><a href="https://raw.github.com/dcepler/unofficial-updater2/master/uu2-cf902-jrun-filechanges.txt">File Changes: ColdFusion 9.0.2 Multi-Server JRun4</a></li>
<li><a href="https://raw.github.com/dcepler/unofficial-updater2/master/uu2-cf902-j2ee-filechanges.txt">File Changes: ColdFusion 9.0.2 J2EE</a></li>
</ul>

<p>If you have modified files in <strong>CFIDE</strong> and/or <strong>WEB-INF</strong> they could be changed due to files contained in the updates from Adobe.</p>
Expand All @@ -82,7 +87,8 @@ <h2>How to use</h2>
<li><a href="https://github.com/downloads/dcepler/unofficial-updater2/Unofficial-Updater2.jar">Download</a> the packaged JAR installer</li>
<li>Stop the ColdFusion Server/process you are going to update</li>
<li>Depending upon your system you might be able to double-click <strong>Unofficial-Updater2.jar</strong> to run it, otherwise it will need to be run from command line
<ul><li><strong>Installer</strong> (auto-detect GUI or text)
<ul><li>On Windows might need to <strong>Run as Administrator</strong> for GUI or opening command prompt</li>
<li><strong>Installer</strong> (auto-detect GUI or text)
<ul><li><code>java -jar Unofficial-Updater2.jar</code></li></ul></li>
<li><strong>Force GUI Installer</strong>
<ul><li><code>java -jar Unofficial-Updater2.jar swing</code></li></ul></li>
Expand All @@ -103,10 +109,9 @@ <h2>How to use</h2>

<h2>Backups</h2>

<p>Backups are made of the directories that are modified. The backups are stored in the directory specified when running UU2
and are named <strong>{directory-name}-uu2-{datetime-stamp}.zip</strong></p>

<p>Please see <a href="https://github.com/dcepler/unofficial-updater2/wiki/Restore-ACF-from-UU2-backups">Wiki: Restore ACF from UU2 backups</a> for details.</p>
<p>Unofficial Updater 2 creates backups of the directories that are modified, but it is <strong>HIGHLY</strong> recommended that you
create your own backups of your ColdFusion installation to restore from in case of a problem. The backups created by UU2
are stored in the directory specified when running UU2 and are named <strong>{directory-name}-uu2-{datetime-stamp}.zip</strong></p>

<h2>Details</h2>

Expand All @@ -117,7 +122,7 @@ <h2>Details</h2>

<h3>ColdFusion 8.0.1</h3>

<p>All hot fixes and security bulletins published as of June 12, 2012 for
<p>All hot fixes and security bulletins published as of September 19, 2012 for
ColdFusion 8.0.1 are applied except if they were superseded by a newer
patch and the following:</p>

Expand All @@ -135,10 +140,16 @@ <h3>ColdFusion 8.0.1</h3>

<h3>ColdFusion 9.0.1</h3>

<p>All hot fixes and security bulletins published as of June 12, 2012 for
<p>All hot fixes and security bulletins published as of September 19, 2012 for
ColdFusion 9.0.1 are applied except if they were superseded by a newer
patch.</p>

<h3>ColdFusion 9.0.2</h3>

<p>All hot fixes and security bulletins published as of September 19, 2012 for
ColdFusion 9.0.2 are applied except if they were superseded by a newer
patch.</p>

<h3>Additional Notes</h3>

<p>Please refer to the various technotes about changes to configuration options
Expand All @@ -151,12 +162,13 @@ <h3>Additional Notes</h3>
<li><a href="http://www.adobe.com/support/security/bulletins/apsb11-29.html">APSB11-29 - Security update: Hotfix available for ColdFusion</a></li>
<li><a href="http://www.adobe.com/support/security/bulletins/apsb12-06.html">APSB12-06 - Security update: Hotfix available for ColdFusion</a></li>
<li><a href="http://www.adobe.com/support/security/bulletins/apsb12-15.html">APSB12-15 - Security update: Hotfix available for ColdFusion 9.0.1 and earlier</a></li>
<li><a href="http://www.adobe.com/support/security/bulletins/apsb12-21.html">APSB12-21 - Security update: Hotfix available for ColdFusion 10 and earlier</a></li>
<li>Additional Information
<ul><li><a href="http://www.cutterscrossing.com/index.cfm/2012/3/27/ColdFusion-Security-Hotfix-and-Big-Forms">ColdFusion Security Hotfix APSB12-06 and Big Forms</a></li></ul></li>
</ul>

<p>Also it is highly recommended to update the underlying JVM that ColdFusion
uses to 1.6.0 Update 24</p>
uses to 1.6.0 Update 24 for ColdFusion 8.0.1 and 9.0.1</p>

<ul>
<li><a href="http://kb2.adobe.com/cps/894/cpsid_89440.html">Oracle Security Alert CVE-2010-4476 | ColdFusion</a></li>
Expand Down
35 changes: 23 additions & 12 deletions README.md
View file
Expand Up @@ -5,26 +5,29 @@ Unofficial Updater 2 (UU2) is an outgrowth of the frustration that came from
trying to manually patch Adobe ColdFusion 8.0.1 with the numerous hot fixes
and security bulletins that have been published. It is a tool to provide
an easy way of consistently applying applicable hot fixes and security
bulletins to Adobe ColdFusion 8.0.1 or 9.0.1.
bulletins to Adobe ColdFusion 8.0.1, 9.0.1, or 9.0.2.

### Disclaimers
1. Use of Unofficial Updater 2 is **at your own risk**
- **Do not** run Unofficial Updater 2 for the first time on a production system
2. Unofficial Updater 2 is **not endorsed by or have any ties** to Adobe
3. ColdFusion Server/process **should not be running** when you use Unofficial Updater 2
4. Unofficial Updater 2 can **only be run against** Adobe ColdFusion **8.0.1** or **9.0.1**
4. Unofficial Updater 2 can **only be run against** Adobe ColdFusion **8.0.1**, **9.0.1**, or **9.0.2**
- If you are running **8.0.0** or **9.0.0** you need to apply Update 1 from Adobe first
- [Adobe ColdFusion 8 Update 1](http://kb2.adobe.com/cps/403/kb403277.html)
- [Adobe ColdFusion 9 Update 1](http://kb2.adobe.com/cps/849/cpsid_84973.html)
5. Unofficial Updater 2 is **updated** whenever Adobe releases a new (or changes) a hot fix or security bulletin
- Matrix of published hot fixes and security bulletins
- [Hot Fix Matrix: ColdFusion 8.0.1](https://github.com/dcepler/unofficial-updater2/blob/master/cf801-hotfix-matrix.pdf?raw=true)
- [Hot Fix Matrix: ColdFusion 9.0.1](https://github.com/dcepler/unofficial-updater2/blob/master/cf901-hotfix-matrix.pdf?raw=true)
- [Hot Fix Matrix: ColdFusion 9.0.2](https://github.com/dcepler/unofficial-updater2/blob/master/cf902-hotfix-matrix.pdf?raw=true)
6. Unofficial Updater 2 will **need to be downloaded and run again** when it is updated to apply all new (or changed) hot fix or security bulletin from Adobe
7. Unofficial Updater 2 works **in most** situations/installs, but if you have something non-standard it might not work
- Consider contacting a [CF-oriented Troubleshooting Consultant](http://www.cf411.com/cfconsult) to ensure you are properly patched

## What it does
First time you run Unofficial Updater 2, it will download **ALL** hotfixes and
security bulletins from Adobe for both ColdFusion 8.0.1 and 9.0.1. UU2 will
security bulletins from Adobe for both ColdFusion 8.0.1, 9.0.1, and 9.0.2. UU2 will
create **Unofficial-Updater2-with-downloads.jar** which contains the
downloaded hotfixes and security bulletins. This is done since UU2
can not directly package the updates and will make it easier to patch
Expand All @@ -39,14 +42,17 @@ UU2 only updates files, it **does not modify** any settings in ColdFusion
such as *neo-***.xml* or *jvm.config*.

A list of files that Unofficial Updater 2 updates as compared to a clean
install of Adobe ColdFusion 8.0.1 or 9.0.1 are listed below:
install of Adobe ColdFusion 8.0.1, 9.0.1, and 9.0.2 are listed below:

- [File Changes: ColdFusion 8.0.1 Standalone](https://raw.github.com/dcepler/unofficial-updater2/master/uu2-cf801-standalone-filechanges.txt)
- [File Changes: ColdFusion 8.0.1 Multi-Server JRun4](https://raw.github.com/dcepler/unofficial-updater2/master/uu2-cf801-jrun-filechanges.txt)
- [File Changes: ColdFusion 8.0.1 J2EE](https://raw.github.com/dcepler/unofficial-updater2/master/uu2-cf801-j2ee-filechanges.txt)
- [File Changes: ColdFusion 9.0.1 Standalone](https://raw.github.com/dcepler/unofficial-updater2/master/uu2-cf901-standalone-filechanges.txt)
- [File Changes: ColdFusion 9.0.1 Multi-Server JRun4](https://raw.github.com/dcepler/unofficial-updater2/master/uu2-cf901-jrun-filechanges.txt)
- [File Changes: ColdFusion 9.0.1 J2EE](https://raw.github.com/dcepler/unofficial-updater2/master/uu2-cf901-j2ee-filechanges.txt)
- [File Changes: ColdFusion 9.0.2 Standalone](https://raw.github.com/dcepler/unofficial-updater2/master/uu2-cf902-standalone-filechanges.txt)
- [File Changes: ColdFusion 9.0.2 Multi-Server JRun4](https://raw.github.com/dcepler/unofficial-updater2/master/uu2-cf902-jrun-filechanges.txt)
- [File Changes: ColdFusion 9.0.2 J2EE](https://raw.github.com/dcepler/unofficial-updater2/master/uu2-cf902-j2ee-filechanges.txt)

If you have modified files in **CFIDE** and/or **WEB-INF** they could be changed due to files contained in the updates from Adobe.

Expand All @@ -73,11 +79,10 @@ If you have modified files in **CFIDE** and/or **WEB-INF** they could be changed

Please see the [Wiki: Using Updater 2](https://github.com/dcepler/unofficial-updater2/wiki/Using-Unofficial-Updater-2) for screenshots and walkthrough.

## Backups
Backups are made of the directories that are modified. The backups are stored in the directory specified when running UU2
and are named **{directory-name}-uu2-{datetime-stamp}.zip**

Please see [Wiki: Restore ACF from UU2 backups](https://github.com/dcepler/unofficial-updater2/wiki/Restore-ACF-from-UU2-backups) for details.
## Backups
Unofficial Updater 2 creates backups of the directories that are modified, but it is **HIGHLY** recommended that you
create your own backups of your ColdFusion installation to restore from in case of a problem. The backups created by UU2
are stored in the directory specified when running UU2 and are named **{directory-name}-uu2-{datetime-stamp}.zip**

## Details
At the core, Unofficial Updater 2 is just an [Apache Ant](http://ant.apache.org/) script. Ant was chosen
Expand All @@ -86,7 +91,7 @@ wrapped with [Ant Installer](http://antinstaller.sourceforge.net/) to create a G
only require Java 1.5+ to be installed.

### ColdFusion 8.0.1
All hot fixes and security bulletins published as of June 12, 2012 for
All hot fixes and security bulletins published as of September 19, 2012 for
ColdFusion 8.0.1 are applied except if they were superseded by a newer
patch and the following:

Expand All @@ -101,10 +106,15 @@ registry and **CVE-2009-1876** will modify the connector configuration.
and [breaks other things](http://www.mischefamily.com/nathan/index.cfm/2009/10/1/hf80171643-Breaks-Application-Specific-Custom-Tag-Paths).

### ColdFusion 9.0.1
All hot fixes and security bulletins published as of June 12, 2012 for
All hot fixes and security bulletins published as of September 19, 2012 for
ColdFusion 9.0.1 are applied except if they were superseded by a newer
patch.

### ColdFusion 9.0.2
All hot fixes and security bulletins published as of September 19, 2012 for
ColdFusion 9.0.2 are applied except if they were superseded by a newer
patch.

### Additional Notes
Please refer to the various technotes about changes to configuration options
since Unofficial Updater 2 only updates files, it **does not modify** any
Expand All @@ -115,11 +125,12 @@ settings in ColdFusion such as *neo-***.xml* or *jvm.config*.
* [APSB11-29 - Security update: Hotfix available for ColdFusion](http://www.adobe.com/support/security/bulletins/apsb11-29.html)
* [APSB12-06 - Security update: Hotfix available for ColdFusion](http://www.adobe.com/support/security/bulletins/apsb12-06.html)
* [APSB12-15 - Security update: Hotfix available for ColdFusion 9.0.1 and earlier](http://www.adobe.com/support/security/bulletins/apsb12-15.html)
* [APSB12-21 - Security update: Hotfix available for ColdFusion 10 and earlier](http://www.adobe.com/support/security/bulletins/apsb12-21.html)
* Additional Information
* [ColdFusion Security Hotfix APSB12-06 and Big Forms](http://www.cutterscrossing.com/index.cfm/2012/3/27/ColdFusion-Security-Hotfix-and-Big-Forms)

Also it is highly recommended to update the underlying JVM that ColdFusion
uses to 1.6.0 Update 24
uses to 1.6.0 Update 24 for ColdFusion 8.0.1 and 9.0.1

* [Oracle Security Alert CVE-2010-4476 | ColdFusion](http://kb2.adobe.com/cps/894/cpsid_89440.html)
* Additional Information
Expand Down
6 changes: 3 additions & 3 deletions antinstall-config.xml
View file
Expand Up @@ -28,7 +28,7 @@
minJavaVersion="1.5"
finishButtonText=" GO! "
wide="600:250"
version="2012.06.26">
version="2012.09.19">

<page type="input" name="welcome" displayText="Welcome to Unofficial Updater 2">
<hidden property="firstRun" value="true" />
Expand All @@ -39,10 +39,10 @@
<comment displayText="Please read the next screen completely before using" title="true" />
<comment displayText="" />
<comment displayText="Unofficial Updater 2 Release" bold="true" />
<comment displayText="2012.06.26"/>
<comment displayText="2012.09.19"/>
<comment displayText="" />
<comment displayText="Latest Security Patch Applied" bold="true" />
<comment displayText="APSB12-15 - June 12, 2012"/>
<comment displayText="APSB12-21 - September 11, 2012"/>

</page>

Expand Down

0 comments on commit 4559054

Please sign in to comment.