COMMAND
	Coldfusion path disclosure
SYSTEMS AFFECTED
	 Coldfusion 5.0 on Windows 2000 w. IIS5
	 ColdFusion 4.0 and 4.5 using IIS 3.0 and 4.0 on Windows NT 4.0 
PROBLEM
	In  KPMG  security  advisory  KPMG-2002013  [http://www.kpmg.dk],  Peter
	Gründl says :
	 Problem
	 =======
	Requests for certain DOS-devices are parsed by  the  isapi  filter  that
	handles .cfm and .dbm  and  result  in  error  messages  containing  the
	physical path to the web root.
	 Details
	 =======
	Requests for non-existant  .cfm  and  .dbm  files  return  a  coldfusion
	"Object Not Found" error message similar to this:
	
	"Error Occurred While Processing Request
	 Error Diagnostic Information
	 An error has occurred.
	 HTTP/1.0 404 Object Not Found"
	
	Requesting a DOS-device, such as nul.dbm or nul.cfm returns:
	
	"Error Occurred While Processing Request
	 Error Diagnostic Information
	 Cannot open CFML file
	 The requested file "C:\data\nul.dbm" cannot be found.
	 The specific sequence of files included or processed is:
	 C:\data\nul.dbm
	 Date/Time: 04/18/02 11:32:16
	 Browser: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; T312461)
	 Remote Address: xxx.xxx.xxx.xxx"
	
	A similar result can be achieved with this request:
	
	/nul..dbm
	
	which returns:
	
	"Error Occurred While Processing Request
	 Error Diagnostic Information
	 The template specification, 'C:\data\nul..dbm', is illegal.
	 Template specifications cannot include '..' nor begin with a backslash
	('\\')."
	
SOLUTION
	 Corrective action
	 =================
	The vendor suggests turning on "Check that file exists":
	Windows 2000:
	
	1. Open the Management console
	2. Click on "Internet Information Services"
	3. Right-click on the website and select "Properties"
	 Update by Christopher Ess
	 =========================
	Work around for IIS 4.0 appears to be identical to for IIS 5.0.  I cannot
	determine any sort of fix for IIS 3.0.
	The one drawback of the work around is that if you go to any .cfm or .dbm
	file that does not exist, you get a standard 404 error from the webserver
	rather than the considerably prettier (not that that says much) 404
	message that ColdFusion returns.
	4. Select "Home Directory"
	5. Click on "Configuration"
	6. Select ".cfm"
	7. Click on "Edit"
	8. Make sure "Check that file exists" is checked
	9. Do the same for ".dbm"