After applying the fix for APSB12-06 the exception below is logged when attempting to upload a file via a form post.
java.lang.NoSuchMethodError: com.oreilly.servlet.multipart.MultipartParser.<init>(Ljavax/servlet/h ttp/HttpServletRequest;J)V
at coldfusion.filter.FormScope.fillMultipart(FormScope.java:177)
at coldfusion.filter.FusionContext.SymTab_initForRequest(FusionContext.j ava:436)
at coldfusion.filter.GlobalsFilter.invoke(GlobalsFilter.java:33)
at coldfusion.filter.DatasourceFilter.invoke(DatasourceFilter.java:22)
at coldfusion.filter.RequestThrottleFilter.invoke(RequestThrottleFilter. java:126)
at coldfusion.CfmServlet.service(CfmServlet.java:198)
at coldfusion.bootstrap.BootstrapServlet.service(BootstrapServlet.java:8 9)
at jrun.servlet.FilterChain.doFilter(FilterChain.java:86)
at coldfusion.monitor.event.MonitoringServletFilter.doFilter(MonitoringS ervletFilter.java:42)
at coldfusion.bootstrap.BootstrapFilter.doFilter(BootstrapFilter.java:46 )
at jrun.servlet.FilterChain.doFilter(FilterChain.java:94)
at jrun.servlet.FilterChain.service(FilterChain.java:101)
at jrun.servlet.ServletInvoker.invoke(ServletInvoker.java:106)
at jrun.servlet.JRunInvokerChain.invokeNext(JRunInvokerChain.java:42)
at jrun.servlet.JRunRequestDispatcher.invoke(JRunRequestDispatcher.java: 286)
at jrun.servlet.ServletEngineService.dispatch(ServletEngineService.java: 543)
at jrun.servlet.jrpp.JRunProxyService.invokeRunnable(JRunProxyService.ja va:203)
at jrunx.scheduler.ThreadPool$DownstreamMetrics.invokeRunnable(ThreadPoo l.java:320)
at jrunx.scheduler.ThreadPool$ThreadThrottle.invokeRunnable(ThreadPool.j ava:428)
at jrunx.scheduler.ThreadPool$UpstreamMetrics.invokeRunnable(ThreadPool. java:266)
at jrunx.scheduler.WorkerThread.run(WorkerThread.java:66)
This occurs on every post which includes a file, regardless of the post/file size. I have edited my neo-runtime.xml file per the patch instructions. Note that the site on which I am seeing this problem uses basic authentication.
If I remove the file {ColdFusion-Home}/lib/updates/hf801-00005.jar and restore the file hf801-00004.jar (which was removed per the patch instructions) the exception no longer occurs.
My environment:
OS: Windows 2003 Server R2, service pack 2, 32bit
ColdFusion: 8.0.1 with all previous security hotfixes applied
JVM: 1.6.0_24
Is there a fix for this problem?
References:
ColdFusion Security Hotfix APSB12-06
http://helpx.adobe.com/coldfusion/kb/coldfusion-security-hotfix.html