Not really going to help me as Web Central will not listen to me. Really need someone from macromedia to follow this up.
Brian Knott -----Original Message----- From: Beattie, Barry Sent: Sunday, 14 December 2003 6:34 PM To: CFAussie Mailing List Subject: [cfaussie] RE: Fwd: Flash Remoting exploits (was: Flash Remoting , WebCentral) kewl, Sean. thanx. gee, that's an effective way top escilate something... Brian Knott @ QANTM: will this help you and webcentral? peace barry.b -----Original Message----- From: Sean A Corfield To: CFAussie Mailing List Sent: 12/13/2003 12:13 PM Subject: [cfaussie] Fwd: Flash Remoting exploits (was: Flash Remoting and - WebCe ntral) I forwarded the comments about the Flash Remoting exploit to the product team and they said: Begin forwarded message: > ...there should be a web.xml servlet init parameter that turns off the > Java-based adapters (i.e. the things in Flash Remoting that locate > Java classes and invoke their methods). I believe these were turned > off by default in CFMX. > > The servlet entry in the web.xml typically looks like this: > > <servlet id="macromedia_servlet_11"> > <servlet-name>FlashGateway</servlet-name> > <display-name>Flash Gateway</display-name> > <description>Allows flash to connect to CFML and CFC > templates.</description> > > <servlet-class>coldfusion.bootstrap.BootstrapServlet</servlet-class> > <init-param> > <param-name>DISABLE_JAVA_ADAPTERS</param-name> > <param-value>false</param-value> > <description>When set to true, this setting > disables the Java Service Adapters in the gateway.</description> > </init-param> > ... In this example, the Java adapters have been specifically re-enabled. Sean A Corfield -- http://www.corfield.org/blog/ "If you're not annoying somebody, you're not really alive." -- Margaret Atwood --- You are currently subscribed to cfaussie as: [EMAIL PROTECTED] To unsubscribe send a blank email to [EMAIL PROTECTED] MXDU2004 + Macromedia DevCon AsiaPac + Sydney, Australia http://www.mxdu.com/ + 24-25 February, 2004 --- You are currently subscribed to cfaussie as: [EMAIL PROTECTED] To unsubscribe send a blank email to [EMAIL PROTECTED] MXDU2004 + Macromedia DevCon AsiaPac + Sydney, Australia http://www.mxdu.com/ + 24-25 February, 2004 --- You are currently subscribed to cfaussie as: [EMAIL PROTECTED] To unsubscribe send a blank email to [EMAIL PROTECTED] MXDU2004 + Macromedia DevCon AsiaPac + Sydney, Australia http://www.mxdu.com/ + 24-25 February, 2004
