[10621] in bugtraq
New Allaire Security Zone Bulletins and KB Articles
daemon@ATHENA.MIT.EDU (aleph1@UNDERGROUND.ORG)
Mon May 24 17:29:21 1999
Message-Id: <19990524220053.32190.qmail@underground.org>
Date: Mon, 24 May 1999 15:00:52 -0700
Reply-To: aleph1@UNDERGROUND.ORG
From: aleph1@UNDERGROUND.ORG
To: BUGTRAQ@NETSPACE.ORG
Dear ColdFusion Customer-
Several new security issues that may affect ColdFusion customers have come to our attention recently. Please visit the Security Zone at the Allaire Web site to learn about these new issues and what actions you can take to address them:
http://www.allaire.com/security
Recently we posted the following new and updated Allaire Security Bulletins and Knowledge Base Articles:
UPDATED
ASB99-02: ColdFusion Example Applications and Sample Code Exposes Servers
ADDED
ASB99-06: Netscape Servers for Win NT Exposure of Source Code with "%20"
ASB99-07: Possible Denial-of-Service Attack Using CF Admin. Start/Stop Utility
ASB99-08: Pages Encrypted with CFCRYPT.EXE Can Be Illegally Decrypted
Article 10954: Security Best Practice: Securing the ColdFusion Administrator
Article 10953: Security Best Practice: Securing File-based DBs (i.e. Access)
Article 10955: Security Best Practice: URL Session Variables and HTTP_REFERRER
As a Web application platform vendor, one of our highest concerns is the security of the systems our customers deploy. We understand how important security is to our customers, and we're committed to providing the technology and information customers need to build secure Web applications. Thank you for your time and consideration on this issue.
-- Damon Cooper
Security Response Team Coordinator, Allaire Corporation
P.S. As a reminder, Allaire has set up an email address that customers can use to report security issues associated with an Allaire product: secure@allaire.com.
