I'm no remoting security expert but doesn't the flash sandbox prevent this from happening? In other words you can only remote from a flash file that has been delivered from the same domain. You can't just remote to any old server from your flash movie -- well that is my understanding.
If you have a standalone movie, it can remote to any server. I used this approach to show how to perform a DoS attack via the Web Services proxy and persuade the product team to provide a way to disable the proxy. I hadn't heard of this Java-based DoS attack before tho'.
Here's where the flag is in your web.xml file:
...
<servlet id="macromedia_servlet_11">
<servlet-name>FlashGateway</servlet-name>
<display-name>Flash Gateway</display-name>
<description>Allows flash to connect to CFML and CFC templates.</description>
<servlet-class>coldfusion.bootstrap.BootstrapServlet</servlet-class> <init-param>
<param-name>DISABLE_CFWS_ADAPTERS</param-name>
<param-value>true</param-value>
<description>When set to true, this setting disables the ColdFusion WebServices Adapters in the gateway.</description>
</init-param>
...
I'm fairly certain that the Java Flash Remoting access referred to in this thread is disabled in the non-J2EE version of CFMX but I'd have to confirm that with the product team. I'm sure there's a similar flag to the above that lets you disable the Java adapter anyway.
Sean A Corfield -- http://www.corfield.org/blog/
"If you're not annoying somebody, you're not really alive." -- Margaret Atwood
--- You are currently subscribed to cfaussie as: [EMAIL PROTECTED] To unsubscribe send a blank email to [EMAIL PROTECTED]
MXDU2004 + Macromedia DevCon AsiaPac + Sydney, Australia http://www.mxdu.com/ + 24-25 February, 2004
