Forgive my language but that is absolute bollocks.

This person is obviously a total novice in as far as security is concerned.





-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
Sent: 07 October 2005 13:51
To: CF-Server
Subject: ColdFusion Security Holes - Best Practices

I heard a challenge from a security consultant that "if you are using
ColdFusion you do not have a secure server."  He maintains that CF is full
of things a hacker can access.  For example he gave the following example.
If you attempt to open a CF website with the following command it will
generate an error message that gives you the IP address of the CF server:

sitename.org/*.cfm

I tried this on a wide variety of sites and found that most CF sites return
the error with the IP address.  Some, however appear to trap this error
somehow.

What should be done on a CF server to prevent that type of error exposing
the IP address of a CF server?

This error is occuring prior to the execution of an application.cfm file in
the host root directory so you cannot programatically trap it.



~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
Discover CFTicket - The leading ColdFusion Help Desk and Trouble 
Ticket application

http://www.houseoffusion.com/banners/view.cfm?bannerid=48

Message: http://www.houseoffusion.com/lists.cfm/link=i:10:5567
Archives: http://www.houseoffusion.com/cf_lists/threads.cfm/10
Subscription: http://www.houseoffusion.com/lists.cfm/link=s:10
Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.10
Donations & Support: http://www.houseoffusion.com/tiny.cfm/54

Reply via email to