Allaire Security Bulletin (ASB00-04)
                  Patch Available for Allaire Spectra 1.0 Security Authentication System

                  Originally Posted: January 31, 2000
                  Last Updated: January 31, 2000

                  Summary
                  There is a security issue with the Spectra 1.0 Remote Access Service invoke.cfm template. Normally
                  users must be authenticated in the webtop security context in order to even attempt to use the
                  Remote Access Service. However, if the user passes a parameter called "bAuthenticated" via the
                  URL, a form field, or a WDDX packet, and the user does not specify a username, a bug allows them
                  to use the Remote Access Service even if they are not in the webtop user directory. Note that this
                  does not pose a problem for secured resources, but it does defeat the extra layer of protection that
                  prevents non-webtop users from using and altering unsecured resources. 

                  Issue
                  There is a security issue with the Spectra 1.0 Remote Access Service invoke.cfm template. Normally
                  users must be authenticated in the webtop security context in order to even attempt to use the
                  Remote Access Service. However, if the user passes a parameter called "bAuthenticated" via the
                  URL, a form field, or a WDDX packet, and the user does not specify a username, a bug allows them
                  to use the Remote Access Service even if they are not in the webtop user directory.

                  The issue directly related to certain variables within the authentication code not being set to proper
                  values, allowing users to parse information through a URL string. The issue exists in the main Spectra
                  Webtop application, the i-Build and the RestoreNet applications.

                  Affected Software Versions
                  · Allaire Spectra 1.0 

                  What Allaire is Doing
                  Allaire has published this bulletin notifying customers of the problem. Allaire has also released new
                  authentication templates that will resolve the authentication bugs. These templates are available for
                  download and inspection. Allaire also recommends that users install sample applications and
                  documentation on secured development servers, and not on production servers.

                       Download - SPECTRA 1.0 Security Authentication System Patches 

                  What Customers Should Do
                  Customers should download and copy the new files into their respective directories, renaming them
                  all to "invoke.cfm", overwriting the old invoke.cfm files. The following is a list of which template goes
                  in which directory:

                  File
                                    Location
                                                                 Rename
                                                                 To
                                                                           Replaces
                  invoke_spectra.cfm
                                    {webroot}\allaire\spectra\ 
                                                                 Invoke.cfm
                                                                           Invoke.cfm
                  invoke_ibuild.cfm 
                                    {webroot}\i-build\
                                                                 Invoke.cfm
                                                                           Invoke.cfm
                  invoke_restorenet.cfm
                                    {webroot}\allaire\spectra\restorenet\ 
                                                                 Invoke.cfm
                                                                           Invoke.cfm


                  Allaire strongly recommends that customers remove all documentation, sample code, example
                  applications, and tutorials from production servers. The examples that are installed with Spectra are
                  installed in the "{webroot}\ibuild", "{webroot}\allaire\spectra\restorenet" and the
                  "{webroot}\allaire\spectra\docs" directories, which are normally installed in the root of the Web server
                  directory. 

                  Access to the {webroot}\allaire\spectra\docs directory should be secured with Operating System and
                  Web Server security on developer workstations. 

                  Customers should also closely monitor their production server web logs for browser HTTP requests
                  attempting to access files in the "/allaire/spectra/docs", "/ibuild", and "/allaire/spectra/restorenet"
                  directories as they would requests for files in the "/cfdocs" or "/cfide/administrator" directories,
                  treating these requests as malicious reconnaissance probes by would-be attackers. 

                  Revisions
                  January 31, 2000 -- Bulletin first created.

                  Reporting Security Issues
                  Allaire is committed to addressing security issues and providing customers with the information on
                  how they can protect themselves. If you identify what you believe may be a security issue with an
                  Allaire product, please send an email to secure@allaire.com. We will work to appropriately address and
                  communicate the issue. 

                  Receiving Security Bulletins
                  When Allaire becomes aware of a security issue that we believe significantly affects our products or
                  customers, we will notify customers when appropriate. Typically this notification will be in the form of
                  a security bulletin explaining the issue and the response. Allaire customers who would like to receive
                  notification of new security bulletins when they are released can sign up for our security notification
                  service. 

                  For additional information on security issues at Allaire, please visit the Security Zone at:
                  http://www.allaire.com/security

                  THE INFORMATION PROVIDED BY ALLAIRE IN THIS BULLETIN IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY
                  KIND. ALLAIRE DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF
                  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL ALLAIRE CORPORATION OR
                  ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
                  CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF ALLAIRE CORPORATION OR ITS
                  SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE
                  EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING
                  LIMITATION MAY NOT APPLY.