You can access and easily see other accounts hosted on that server or even gain control of the server itself. If the CF service is under "Local System" account privileges which is the default, cfexecute will have complete access to the server's file system. CFExecute should be turned off and the CF services should be under a custom "restricted" account system account.

John
[email protected]




Clarke Bishop wrote:
The host in question is Media3.net. And, unfortunately while investigating the 
DB driver question, I discovered they DO have cfexecute turned on!

I recommended they consider Fusionlink, but they picked Media3 because they were listed as a partner on Adobe's website, and because they were turned on by cool control panels and the illusion of control.
I can guess why cfexecute is a bad idea, but why exactly -- What's a good 
example of the risk?

Thanks,

   Clarke

-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of John Mason
Sent: Wednesday, July 08, 2009 2:54 PM
To: [email protected]
Subject: Re: [ACFUG Discuss] ColdFusion and MySQL

And if they have cfexecute access turn on, get off that host :)

John


Teddy R. Payne wrote:
If you have CFEXECUTE ability, here is a curious post for that question:

http://blog.pengoworks.com/index.cfm/2008/1/15/Display-ColdFusion-JDBC-Drivers-on-Windows


Teddy R. Payne, ACCFD
Google Talk - [email protected] <mailto:[email protected]>



On Wed, Jul 8, 2009 at 2:48 PM, John Mason <[email protected] <mailto:[email protected]>> wrote:

    You'll need to ask the host.

    John



    Clarke Bishop wrote:

        Can I find that out directly, or do I have to ask the host?

          Clarke

        -----Original Message-----
        From: [email protected] <mailto:[email protected]>
        [mailto:[email protected] <mailto:[email protected]>] On Behalf Of
        John Mason
        Sent: Wednesday, July 08, 2009 2:31 PM
        To: [email protected] <mailto:[email protected]>
        Subject: Re: [ACFUG Discuss] ColdFusion and MySQL

        Can you verify that the datasource is using the 4.x driver?

        John


        Clarke Bishop wrote:
            Thanks Wes and everyone else who replied!

            Here are the specifics on the configuration:

            ColdFusion
            Version: 8,0,1,195765  Enterprise
            OS: Windows Vista Version 6.0 (That's kind of scary!)

            MySQL
            Version: 4.1.22
            OS: Redhat Linux
            Server_Engine: MyISAM

            Thanks,

              Clarke

            -----Original Message-----
            From: [email protected] <mailto:[email protected]>
            [mailto:[email protected] <mailto:[email protected]>] On
            Behalf Of Wes Byrd
            Sent: Wednesday, July 08, 2009 11:02 AM
            To: [email protected] <mailto:[email protected]>
            Subject: RE: [ACFUG Discuss] ColdFusion and MySQL

            I use CF8 with MySQL almost exclusively.  I use both 4.x
            and 5.x MySQL.
            I have 200+ websites using this scenario and have never
            seen this error.
            There are ton of things to consider for trouble shooting
            this.  One is
            your datasource.  How is that setup?  Another the code
            itself.  Yet
            another is the database and table setup (innoDB, MyISAM,
            etc...).  Any
            chance we can get these details to help assist further?

            Wes


            -----Original Message-----
            From: [email protected] <mailto:[email protected]>
            [mailto:[email protected] <mailto:[email protected]>] On
            Behalf Of Clarke
            Bishop
            Sent: Wednesday, July 08, 2009 10:42 AM
            To: [email protected] <mailto:[email protected]>
            Subject: [ACFUG Discuss] ColdFusion and MySQL

            I am troubleshooting an application that uses ColdFusion 8
            and MySQL.
            Intermittently, it throws the error below.
            I've seen on the web where others have had a similar
            problem. Have any
            of
            you seen this? Do you know of a fix?

            Thanks,

              Clarke

            p.s. I originally posted this to the wrong list, so if
            you're on both
            lists,
            please forgive me!

            java.lang.NullPointerException at
            com.mysql.jdbc.Statement.setMaxRows(Statement.java:2178) at
            
coldfusion.server.j2ee.sql.JRunStatement.setMaxRows(JRunStatement.java:2
            14)
            at
            coldfusion.sql.Executive.executeQuery(Executive.java:1276) at
            coldfusion.sql.Executive.executeQuery(Executive.java:1008) at
            coldfusion.sql.Executive.executeQuery(Executive.java:939) at
            coldfusion.sql.SqlImpl.execute(SqlImpl.java:325) at
            coldfusion.tagext.sql.QueryTag.executeQuery(QueryTag.java:831)
            at
            coldfusion.tagext.sql.QueryTag.doEndTag(QueryTag.java:521) at
            cfdbTest32ecfm1104898290.runPage(E:\web\engravedforever.com
            <http://engravedforever.com>\WebTools\dbT
            est3
            .cfm:20) at
            coldfusion.runtime.CfJspPage.invoke(CfJspPage.java:196) at
            coldfusion.tagext.lang.IncludeTag.doStartTag(IncludeTag.java:370)
            at
            coldfusion.filter.CfincludeFilter.invoke(CfincludeFilter.java:65)
            at
            
coldfusion.filter.ApplicationFilter.invoke(ApplicationFilter.java:273)
            at
            
coldfusion.filter.RequestMonitorFilter.invoke(RequestMonitorFilter.java:
            48)
            at
            coldfusion.filter.MonitoringFilter.invoke(MonitoringFilter.java:40)
            at
            coldfusion.filter.PathFilter.invoke(PathFilter.java:86) at
            coldfusion.filter.ExceptionFilter.invoke(ExceptionFilter.java:70)
            at
            
coldfusion.filter.BrowserDebugFilter.invoke(BrowserDebugFilter.java:74)
            at
            
coldfusion.filter.ClientScopePersistenceFilter.invoke(ClientScopePersist
            ence
            Filter.java:28) at
            coldfusion.filter.BrowserFilter.invoke(BrowserFilter.java:38)
            at
            coldfusion.filter.NoCacheFilter.invoke(NoCacheFilter.java:46)
            at
            coldfusion.filter.GlobalsFilter.invoke(GlobalsFilter.java:38)
            at
            coldfusion.filter.DatasourceFilter.invoke(DatasourceFilter.java:22)
            at
            coldfusion.CfmServlet.service(CfmServlet.java:175) at
            
coldfusion.bootstrap.BootstrapServlet.service(BootstrapServlet.java:89)
            at
            jrun.servlet.FilterChain.doFilter(FilterChain.java:86) at
            
coldfusion.monitor.event.MonitoringServletFilter.doFilter(MonitoringServ
            letF
            ilter.java:42) at
            
coldfusion.bootstrap.BootstrapFilter.doFilter(BootstrapFilter.java:46)
            at
            jrun.servlet.FilterChain.doFilter(FilterChain.java:94) at
            jrun.servlet.FilterChain.service(FilterChain.java:101) at
            jrun.servlet.ServletInvoker.invoke(ServletInvoker.java:106) at
            jrun.servlet.JRunInvokerChain.invokeNext(JRunInvokerChain.java:42)
            at
            
jrun.servlet.JRunRequestDispatcher.invoke(JRunRequestDispatcher.java:286
            ) at
            
jrun.servlet.ServletEngineService.dispatch(ServletEngineService.java:543
            ) at
            
jrun.servlet.jrpp.JRunProxyService.invokeRunnable(JRunProxyService.java:
            203)
            at
            
jrunx.scheduler.ThreadPool$DownstreamMetrics.invokeRunnable(ThreadPool.j
            ava:
            320) at
            
jrunx.scheduler.ThreadPool$ThreadThrottle.invokeRunnable(ThreadPool.java
            :428
            ) at
            
jrunx.scheduler.ThreadPool$UpstreamMetrics.invokeRunnable(ThreadPool.jav
            a:26
            6) at jrunx.scheduler.WorkerThread.run(WorkerThread.java:66)






            -------------------------------------------------------------
            To unsubscribe from this list, manage your profile @
            http://www.acfug.org?fa=login.edituserform

            For more info, see http://www.acfug.org/mailinglists
            Archive @ http://www.mail-archive.com/discussion%40acfug.org/
            List hosted by http://www.fusionlink.com
            -------------------------------------------------------------





            -------------------------------------------------------------
            To unsubscribe from this list, manage your profile @
            http://www.acfug.org?fa=gin.edituserform

            For more info, see http://www.acfug.org/mailinglists
            Archive @ http://www.mail-archive.com/discussion%40acfug.org/
            List hosted by http://www.fusionlink.com
            -------------------------------------------------------------





            -------------------------------------------------------------
            To unsubscribe from this list, manage your profile @
            http://www.acfug.org?fa=login.edituserform

            For more info, see http://www.acfug.org/mailinglists
            Archive @ http://www.mail-archive.com/discussion%40acfug.org/
            List hosted by http://www.fusionlink.com
            -------------------------------------------------------------







        -------------------------------------------------------------
        To unsubscribe from this list, manage your profile @
        http://www.acfug.org?fa=login.edituserform

        For more info, see http://www.acfug.org/mailinglists
        Archive @ http://www.mail-archive.com/discussion%40acfug.org/
        List hosted by http://www.fusionlink.com
        -------------------------------------------------------------





        -------------------------------------------------------------
        To unsubscribe from this list, manage your profile @
        http://www.acfug.org?fa=login.edituserform

        For more info, see http://www.acfug.org/mailinglists
        Archive @ http://www.mail-archive.com/discussion%40acfug.org/
        List hosted by http://www.fusionlink.com
        -------------------------------------------------------------







    -------------------------------------------------------------
    To unsubscribe from this list, manage your profile @
    http://www.acfug.org?fa=login.edituserform

    For more info, see http://www.acfug.org/mailinglists
    Archive @ http://www.mail-archive.com/discussion%40acfug.org/
    List hosted by http://www.fusionlink.com
    -------------------------------------------------------------







-------------------------------------------------------------
To unsubscribe from this list, manage your profile @ http://www.acfug.org?fa=login.edituserform

For more info, see http://www.acfug.org/mailinglists
Archive @ http://www.mail-archive.com/discussion%40acfug.org/
List hosted by http://www.fusionlink.com
-------------------------------------------------------------





-------------------------------------------------------------
To unsubscribe from this list, manage your profile @ http://www.acfug.org?fa=gin.edituserform

For more info, see http://www.acfug.org/mailinglists
Archive @ http://www.mail-archive.com/discussion%40acfug.org/
List hosted by http://www.fusionlink.com
-------------------------------------------------------------







-------------------------------------------------------------
To unsubscribe from this list, manage your profile @ http://www.acfug.org?fa=login.edituserform

For more info, see http://www.acfug.org/mailinglists
Archive @ http://www.mail-archive.com/discussion%40acfug.org/
List hosted by http://www.fusionlink.com
-------------------------------------------------------------



Reply via email to