STIGQter STIGQter: STIG Summary: Adobe ColdFusion Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

Before installing or upgrading ColdFusion, the integrity of the installation package must be manually verified.

DISA Rule

SV-279038r1171464_rule

Vulnerability Number

V-279038

Group Title

SRG-APP-000131-AS-000002

Rule Version

APAS-CF-000171

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

1. Obtain the official vendor-provided cryptographic hash for the ColdFusion installation or upgrade package.

2. Before installation or upgrade, compute the hash value locally using an approved tool (e.g., certutil or sha256sum).

3. Compare the computed hash against the vendor-provided hash.

a. If the values match, proceed with installation or upgrade.

b. If the values do not match, do not proceed. Redownload the package from a trusted source and reverify until the hash matches.

4. Maintain documentation of the verification process for auditing purposes.

Check Contents

Verify hash by obtaining the official cryptographic hash for the ColdFusion installation or upgrade package from the Adobe-provided source.

1. On the system where the package is stored, compute the hash value using an approved tool (e.g., certutil on Windows or sha256sum on Linux).

Windows Example:
certutil -hashfile ColdFusionInstaller.exe SHA256

Linux Example:
sha256sum ColdFusionInstaller.bin

2. Compare the computed hash against the vendor-provided hash value.

If the computed hash does not exactly match the vendor-provided hash, this is a finding.

If there is no documented evidence that a manual hash verification was performed prior to installation or upgrade, this is a finding.

Vulnerability Number

V-279038

Documentable

False

Rule Version

APAS-CF-000171

Severity Override Guidance

Verify hash by obtaining the official cryptographic hash for the ColdFusion installation or upgrade package from the Adobe-provided source.

1. On the system where the package is stored, compute the hash value using an approved tool (e.g., certutil on Windows or sha256sum on Linux).

Windows Example:
certutil -hashfile ColdFusionInstaller.exe SHA256

Linux Example:
sha256sum ColdFusionInstaller.bin

2. Compare the computed hash against the vendor-provided hash value.

If the computed hash does not exactly match the vendor-provided hash, this is a finding.

If there is no documented evidence that a manual hash verification was performed prior to installation or upgrade, this is a finding.

Check Content Reference

M

Target Key

5724