Coldfusion, IIS PCI Scan ServletExec vunerability? - iis

I have a 64bit server with the Coldfusion 9.0.2 with IIS, our latest server scan for PCI compliance returned the following error as "urgent"
Unify eWave ServletExec 3.0C UploadServlet Unprivileged File Upload
Is this part of Coldfusion? or IIs.
is it safe to remove it?
how do i remove it?

Related

junk chars in mapped drive url to access WebDAV store

I came across a strange problem. I m using WebDAV to access files over the network and using windows explorer to map a drive to the webDav URL.
In some windows client systems when I try accessing the file store the WebDAV server is receiving junk character with the URL and the search / get fails to produce any output.
Have anyone faced a similar issue and is there any solution for it.
OS : Oracle Enterprise Linux
WebDAV is deployed as a web application on a weblogic 11g server.
Client: windows 7 SP1
It seems to be a multi locale keyboard issue.
UPDATE:
It is because of a McAfee endpoint encryption on the client machine. Was able to reproduce it after applying the encryption.

Why this Help Desk System redirects me to the old server?

I am using the Liberum Help Desk as a Service Request System. It is host on a server that is running Windows Server 2008 R2 32-bit. I configured it with an Access database. It works well. Now, I am trying to shift it to another server running Windows Server 2008 R2 64-bit. At the beginning, I have an error with the JET driver, because there is no JET driver for the 64-bit machines. I fixed it by enabling 32-bit option in the advanced settings of the application pool. However, I am still facing a strange problem which is the following:
When I tried to browse the system that is on the new server (64-bit), it will redirect me to the system hosted on the old server (32-bit) and I don't know why. I checked the code to see if there is any link or something for redirecting me to the old server and I did find anything.
So how to fix this problem? what is the reason of it?
Finally, I found the solution. The problem was with the Access Database; there is a table called config and inside it there is a column for determining the link. I changed the link there and everything works fine.

Serving files from linux share on IIS 6.0

dHi, I'm trying to setup my IIS server (6.0) to serve files from a linux share.
As I'm pretty unfamiliar with linux I ask the community for any input on this.
I've had problems even having IIS server serve content from another windows machine share, this could be a prolem with our domain. The iis server is not on the domain.
As I want to move more towards open source and linux I think having a simple file server is a good way to start.
I took the linux distro chooser at http://www.zegeniestudios.net and it recommends OpenSuse/Mandriva/Ubuntu.
Any oppinions on that would be welcome aswell.
You could use Samba to crate a Windows share on Linux.

Server Error : The server closed the connection while reading the response

I have windows xp and iis installed , when I want to access localhost to view asp pages , I get the following error :
Server Error
The following error occurred:
[code=SERVER_RESPONSE_CLOSE] The server closed the connection while reading the response. Contact your system administrator.
Please contact the administrator
thank you .
There's a few causes of this, including a corrupt IIS metabase (which basically means you need to remove the \inetsrv folder from your PC and reinstall IIS).
Most likely is that you have more than 10 connections open to your local IIS at one time. To support more you'll need to use a server operating system such as Windows Server 2003.

HTTPS in IIS 5.1

I'm using IIS 5.1 in Windows XP on my development computer. I'm going to set up HTTPS on my company's web server, but I want to try doing it locally before doing it on a production system.
But when I go into the Directory Security tab of my web site's configuration section, the "Secure communication" groupbox is disabled. Is there something I need to do to make this groupbox enabled?
That is because IIS 5.1 under the limited Windows XP version is limited to only HTTP. You need to have a full version of IIS 6.0 on Windows 2003 to do this. Luckily you can download a VHD image of Windows 2003 from Microsoft and run it under a Virtual PC instance. Plus I would recommend this since you are trying to be careful and use a machine close to your production environment. IIS 5.1 version is never deployed as a production machine so you cannot guarantee anything and the differences between IIS 5.1 and IIS 6.0 are significant enough where the VM is worth your while.
You may need to manually create a certificate first (on WinXP there does not seem to be a built-in mechanism, so you need to use OpenSSL). Check out these two links:
Enabling SSL in IIS on Windows XP Professional
Enabling SSL (HTTPS) for IIS in Windows XP

Resources