Allaire Security Bulletin (ASB00-02)
                  Addressing Potential Denial Of Service Problem With Installation Files In Allaire Spectra
                  1.0

                  Originally Posted: January 4, 2000
                  Last Updated: January 4, 2000

                  Summary
                  When installing Allaire Spectra 1.0, a web-based Configuration Wizard is used to finalize a
                  number of configuration settings, including a step which indexes data collections on the server.
                  This step of the Configuration Wizard can be accessed via URL and the collections can be
                  resubmitted for indexing. This could be used in a denial of service attack on an Allaire Spectra
                  server. 

                  Issue
                  The directory webroot/allaire/spectra/install/ provides the configuration wizard that allows users
                  to index their collections, test the security configuration, and test the COAPI. This URL is
                  accessible via browser, and is installed with Spectra. While the contents of this directory
                  cannot be used to otherwise damage or destroy server content or data, the URL could be used
                  as a part of a denial of service attack. Since the indexing step of the Wizard is
                  processor-intensive, a malicious user could potentially call the step repeatedly to cause a busy
                  server while the collections are indexed repeatedly. 

                  Affected Software Versions
                  · Spectra 1.0.

                  What Allaire is Doing
                  Allaire intends to address this vulnerability in the next release of Spectra. In the interim, Allaire
                  has released this bulletin to notify customers of the issue. Allaire recommends that customers
                  deploying Spectra 1.0 secure or remove the "install" directory once the Configuration Wizard
                  has been run successfully, as outlined below.

                  What Customers Should Do
                  Customers should secure or remove the following "install" directory from all Spectra servers
                  once the Configuration Wizard has been run successfully to ensure that are not vulnerable to an
                  attack via this directory: 

                         webroot/allaire/spectra/install/


                  Revisions
                  January 4, 2000 -- Bulletin first created.

                  Reporting Security Issues
                  Allaire is committed to addressing security issues and providing customers with the information
                  on how they can protect themselves. If you identify what you believe may be a security issue
                  with an Allaire product, please send an email to secure@allaire.com. We will work to
                  appropriately address and communicate the issue. 

                  Receiving Security Bulletins
                  When Allaire becomes aware of a security issue that we believe significantly affects our products
                  or customers, we will notify customers when appropriate. Typically this notification will be in the
                  form of a security bulletin explaining the issue and the response. Allaire customers who would
                  like to receive notification of new security bulletins when they are released can sign up for our
                  security notification service. 

                  For additional information on security issues at Allaire, please visit the Security Zone at:
                  http://www.allaire.com/security

                  THE INFORMATION PROVIDED BY ALLAIRE IN THIS BULLETIN IS PROVIDED "AS IS" WITHOUT WARRANTY OF
                  ANY KIND. ALLAIRE DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE
                  WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL
                  ALLAIRE CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING
                  DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES,
                  EVEN IF ALLAIRE CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH
                  DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR
                  CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.