Dear ColdFusion Customer- Several new security issues that may affect ColdFusion customers have come to our attention recently. Please visit the Security Zone at the Allaire Web site to learn about these new issues and what actions you can take to address them: http://www.allaire.com/security Recently we posted the following new and updated Allaire Security Bulletins and Knowledge Base Articles: UPDATED ASB99-02: ColdFusion Example Applications and Sample Code Exposes Servers ADDED ASB99-06: Netscape Servers for Win NT Exposure of Source Code with "%20" ASB99-07: Possible Denial-of-Service Attack Using CF Admin. Start/Stop Utility ASB99-08: Pages Encrypted with CFCRYPT.EXE Can Be Illegally Decrypted Article 10954: Security Best Practice: Securing the ColdFusion Administrator Article 10953: Security Best Practice: Securing File-based DBs (i.e. Access) Article 10955: Security Best Practice: URL Session Variables and HTTP_REFERRER As a Web application platform vendor, one of our highest concerns is the security of the systems our customers deploy. We understand how important security is to our customers, and we're committed to providing the technology and information customers need to build secure Web applications. Thank you for your time and consideration on this issue. -- Damon Cooper Security Response Team Coordinator, Allaire Corporation P.S. As a reminder, Allaire has set up an email address that customers can use to report security issues associated with an Allaire product: secureat_private
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:46:42 PDT