Allaire Security Bulletin (ASB00-20)
                  Microsoft: Patch Available for "Absent Directory Browser Argument"
                  Vulnerability

                  Originally Posted: July 31, 2000
                  Last Updated: July 31, 2000 

                  Summary

                  Microsoft has released a patch that eliminates two security vulnerabilities in
                  Microsoft(r) Internet Information Server. In sum, the vulnerabilities could allow a
                  malicious user to stop the web server from providing useful service, or to extract
                  certain types of information from it. This is not a problem with ColdFusion Server itself,
                  but it is an issue that can affect ColdFusion users. Allaire recommends that customers
                  follow the instructions posted on the Microsoft Web site to address this issue.

                  Issue

                  This issue is clearly explained in the Microsoft Security Bulletin:

                      
                     There are two vulnerabilities at issue here:

                                                                                 
                     •
                            The ?Absent Directory Browser Argument? vulnerability. An
                            administrative script installed as part of IIS 3.0 but preserved on
                            upgrade to IIS 4.0 or IIS 5.0 does not correctly handle the case
                            where an expected argument is missing. The absence of the
                            argument causes the script to go into an infinite loop, at which point
                            the script consumes all CPU resources on the server. In addition, the
                            permissions on this tool and several related ones, which were
                            appropriate under IIS 3.0, are inappropriate under IIS 4.0 and 5.0.
                            This could allow web site visitors to use these tools, which provide
                            the ability to view the directory structure on the server. 

                     •
                            A new variant on the ?File Fragment Reading via .HTR? vulnerability.
                            The original version of this vulnerability was discussed in Microsoft
                            Security Bulletin MS00-031. The new vulnerability differs only in
                            the specific way that it could be exploited - like the original
                            version, the effect of the vulnerability is that fragments of .ASP and
                            other files could potentially be retrieved from the server. As in the
                            original version, the mechanics of the new variant make it likely
                            that the parts of an .ASP file most interesting to a malicious user
                            would be stripped out. 


                  Source: Microsoft Security Bulletin (MS00-044) [online]. [Redmond, Washington, USA] :
                  Microsoft, July 2000 [cited 28 July 2000]. Available from World Wide Web:
                  <http://www.microsoft.com/technet/security/bulletin/ms00-044.asp>. 

                  Affected Software Versions

                       Microsoft Internet Information Server 4.0 
                       Microsoft Internet Information Server 5.0 

                  What Allaire is Doing

                  This is not an Allaire product. We are recommending that customers reference the
                  information at Microsoft's site to address this issue.

                  What Customers Should Do

                  There is a patch available to correct this problem. It is detailed in the following
                  Microsoft Security Bulletin (MS00-044):

                  http://www.microsoft.com/technet/security/bulletin/ms00-044.asp.

                  Please note: this issue and patch may not be required for all users. Allaire
                  customers should review all material in the Microsoft Security Bulletin and
                  related documents carefully before applying the patch. As always, customers
                  should test patch changes in a testing environment before modifying
                  production servers.

                  Revisions
                  July 31, 2000 -- Bulletin first created.

                  Reporting Security Issues 
                  Allaire is committed to addressing security issues and providing customers with the
                  information on how they can protect themselves. If you identify what you believe may
                  be a security issue with an Allaire product, please send an email to secure@allaire.com.
                  We will work to appropriately address and communicate the issue. 

                  Receiving Security Bulletins 
                  When Allaire becomes aware of a security issue that we believe significantly affects
                  our products or customers, we will notify customers when appropriate. Typically this
                  notification will be in the form of a security bulletin explaining the issue and the
                  response. Allaire customers who would like to receive notification of new security
                  bulletins when they are released can sign up for our security notification service. 

                  For additional information on security issues at Allaire, please visit the Security Zone at:
                  http://www.allaire.com/security.

                  THE INFORMATION PROVIDED BY ALLAIRE IN THIS BULLETIN IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY
                  KIND. ALLAIRE DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF
                  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL ALLAIRE CORPORATION OR
                  ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
                  CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF ALLAIRE CORPORATION OR ITS
                  SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE
                  EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING
                  LIMITATION MAY NOT APPLY. 

                  Allaire reserves the right, from time to time, to update the information in this document
                  with current information.