[USEMAP]
   [USEMAP]
   
   
     [LINK] 
   
   Allaire Security Bulletin (ASB00-24)
   Microsoft (MS00-060): Patch Available for "IIS Cross-Site Scripting" Vulnerabilities
   
   Originally Posted: September 11, 2000
   Last Updated: September 11, 2000
   Summary
   
   Microsoft has released a patch that eliminates security vulnerabilities in Microsoft(r) Internet Information Server. The
   vulnerabilities could allow a malicious web site operator to misuse another web site as a means of attacking users. This
   is not an issue with ColdFusion Server, but it is an issue that can affect ColdFusion users, as described in the Issue
   section. Allaire recommends that customers follow the instructions posted on the Microsoft web site to address this issue.
   Issue
   
   This issue is clearly explained in the Microsoft Security Bulletin (MS00-060):
        On February 20, 2000, Microsoft and CERT published information on a newly-identified security vulnerability affected
   all web server products. This vulnerability, known as Cross-Site Scripting (CSS), results when web applications dont
   properly validate inputs before using them in dynamic web pages. If a malicious web site operator were able to lure a user
   to his site, and had identified a third-party web site that was vulnerable to CSS, he could potentially use the
   vulnerability to inject script into a web page created by the other web site, which would then be delivered to the user.
   The net effect would be to cause the malicious users script to run on the users machine using the trust afforded the other
   site.
   The vulnerability can affect any software that runs on a web server, accepts user input, and blindly uses it to generate
   web pages. Microsoft recommended that all vendors check their products to see if any are affected by the vulnerability,
   and initiated a check of its own products as well. Several features in IIS were found to be affected some were found by
   Microsoft internal teams, and others were identified by customers and this patch eliminates all of them.      Source:
   Microsoft Security Bulletin (MS00-060) [online]. [Redmond, Washington, USA] : Microsoft, September 2000 [cited 06
   September 2000]. Available from World Wide Web: <http://www.microsoft.com/technet/security/bulletin/ms00-060.asp>.
   Affected Software Versions
     * Microsoft Internet Information Server 4.0
     * Microsoft Internet Information Server 5.0
       
   What Allaire is Doing
   
   This is not an Allaire product. We are recommending that customers reference the information at Microsoft's web site to
   address this issue.
   What Customers Should Do
   
   There is a patch available to correct this problem. It is detailed in the following Microsoft Security Bulletin
   (MS00-060):
   
   http://www.microsoft.com/technet/security/bulletin/ms00-060.asp.
   
   Please note: this issue and patch may not be required for all users. Allaire customers should review all material in the
   Microsoft Security Bulletin and related documents carefully before applying the patch. As always, customers should test
   patch changes in a testing environment before modifying production servers.
   Revisions
   September 11, 2000 -- Bulletin first created. Reporting Security Issues
   Allaire is committed to addressing security issues and providing customers with the information on how they can protect
   themselves. If you identify what you believe may be a security issue with an Allaire product, please send an email to
   secure@allaire.com. We will work to appropriately address and communicate the issue.
   
   Receiving Security Bulletins
   When Allaire becomes aware of a security issue that we believe significantly affects our products or customers, we will
   notify customers when appropriate. Typically this notification will be in the form of a security bulletin explaining the
   issue and the response. Allaire customers who would like to receive notification of new security bulletins when they are
   released can sign up for our security notification service.
   
   For additional information on security issues at Allaire, please visit the Security Zone at:
   http://www.allaire.com/security.
   THE INFORMATION PROVIDED BY ALLAIRE IN THIS BULLETIN IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. ALLAIRE DISCLAIMS
   ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
   PURPOSE. IN NO EVENT SHALL ALLAIRE CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT,
   INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF ALLAIRE CORPORATION OR ITS
   SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF
   LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.
   
   Allaire reserves the right, from time to time, to update the information in this document with current information.
   
   < a l l a i r e >
   Copyright © 1995-2000 Allaire Corp., All rights reserved.
   Year 2000 (Y2K)    Site problems?    Service questions?     Privacy Policy