Crossdomain.xml on non-port 80

Help! I have an application that MUST go on a non-port 80 web
server. Port 80 is used by an embedded security device and can't be
altered. Regardless, the application must be served from a
different port for other security reasons.
I can't put a crossdomain.xml on, let's say, port 60000 at
the root of the web server. It doesn't work. There isn't even an
attempt to get to it.
What can I do?
My crossdomain.xml looks like...
<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "
http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

Use Security.loadPolicyFile("xmlsocket://host:port"); and
you'll have to process the XML request and send the crossdomain.xml
file in response. This is NOT an HTTP request though, just a direct
XML socket communication so you have to have a server socket to
handle it. This is only necessary for XMLSocket and Socket
connections for remote hosts and/or ports under port 1024.
If you are trying to do an HTTPService then you can just
specify the Security.loadPolicyFile("
http://wherever:60000/crossdomain.xml");

Similar Messages

  • How can I serve crossdomain.xml file on a specific port?

    Let me introduce my problem step by step:
    I was using a socket connection on the address www.mydomain.com:1925 to provide a chat service for my users. When I moved to cloudflare, I could not connect to port 1925 directly because of the fact that my requests were reaching my origin server over cloudflare and the port was changing.
    How did I solve it? I created a subdomain chat.mydomain.com whose DNS settings point to my origin server not cloudflare. I bypassed cloudflare by this way and I connected my chat service by using chat.mydomain.com:1925 on the browser. So far so good.
    Here is the problem. I am also using Flash and AS3. It is the core of my game on the site. Chat is working on html and my game in flash is in some part of my website. In flash, I was sending scores of players using again a socket connection on www.mydomain.com:1925 by a different namespace.(Since swf's host and url's host matched, I didn't have any problem I think).Since I have changed the domain to chat.mydomain.com:1925, Flash started to request a crossdomain.xml on chat.mydomain.com:1925. There is a crossdomain.xml file on chat.mydomain.com however I cannot serve it from chat.mydomain.com:1925. Here is my code:
    Security.loadPolicyFile("https://chat.mydomain.com/crossdomain.xml");
    var urlLoader:URLLoader = new URLLoader ();
    var url:String = "https://chat.mydomain.com:1925/socket.io/1/";
    var request:URLRequest = new URLRequest(url);
    request.method = URLRequestMethod.POST; 
    urlLoader.dataFormat = URLLoaderDataFormat.TEXT;
    urlLoader.addEventListener(Event.COMPLETE, completeHandler);
    urlLoader.addEventListener(IOErrorEvent.IO_ERROR,ioErrorHandler);
    urlLoader.load(request);
    Since flash cannot find crossdomain.xml by getting 404, the requests in my code do not work. How can I solve this problem? How can I use the origin chat.mysite.com:1925?

    You're going to have to host it in a way that lets you serve HTTP/S content (at least the crossdomain.xml) on port 80 or 443 respectively.
    The Flash Player Security Whitepaper has an excellent breakdown of the requirements for crossdomain policy stuff:
    White paper: Adobe Flash Player 10 security | Adobe Developer Connection

  • Ye Olde crossdomain.xml

    An App I was working on just went into production on
    Saturday. We have this setup: A weblogic application server (Server
    A) running on Machine A (a solaris OS). We have a separate weblogic
    server located on Machine B.
    Machine A's weblogic hosts the web application and one of the
    pages has a Flex app built in Flex Builder 2.0. This app accesses a
    webservice located on Machine B. In our system test environment
    this worked fine. It also works fine running it with the Run button
    in Flex Builder. When it was deployed to production this weekend, I
    get this error: Unable to load WSDL. If currently online, please
    verify the URL and/or format of the WSDL. I figure it is something
    wrong with crossdomain.xml. I have tried everything.
    Machine A: Port 7001 (crossdomain.xml accessible at
    machinea:7001/crossdomain.xml).
    Machine B: port 4444 (crossdomain.xml accessible at
    machineb:4444/crossdomain.xml).
    I've also tried to load it with Security.loadPolicyFile(url).
    None of this has worked and it always returns the same error. I'd
    really like to get this resolved, as like I said it worked in our
    test environment but is broken in production.

    Just to cover the basics, can you:
    1) test using a wide open cross-domain.xml on machineb?
    <allow-access-from domain="*" />
    2) confirm the URL of the service port at the bottom of the
    wsdl?
    The service port defines where the actual webservice can be
    found and may or may not be on the same server that hosts the wsdl.
    One problem might be that in testing the service port was using a
    canonical domain name that only resolvable on a private intranet,
    and breaks on public facing servers.
    3) run a packet sniffer on the client where Flash Player is
    running and trace connections from the client to machineb ?
    a) you should see an HTTP request / response for
    crossdomain.xml on machineb over port 4444
    b) you should see an HTTP request / response for the wsdl on
    machineb over port 4444
    c) you should see the HTTP req as a POST to the service port
    URL that sends the SOAP Request embedded in the SOAP envelope.
    d) you should see the HTTP response from the service port
    URL with the SOAP response inside a SOAP envelope
    4) Run the Eclipse WTP WebService Explorer from the same
    machine as the client with Flash Player. Type in the WSDL URL into
    the designated field, and Eclipse WTP will parse the wsdl and
    provide a form to permit you to enter data to properly fulfill the
    SOAP Request.
    Eclipse WTP is a great reference tool for testing webservices
    and can be used for troubleshooting by comparison.
    Please let me know how it goes.

  • Apache proxypass and crossdomain.xml not working

    Hi everyone,
    I have the following problem. I have set up jboss on a Linux server connecting to local port 8080 (localhost:8080).
    I have opened the application on port 80 with Apache ( www.myDomain.com) and set up a virtual host that proxies
    this connection to localhost:8080 where jboss is listening.
    <VirtualHost *:80>
        DocumentRoot /var/www/nyDomain
        ServerName myDomain.com
        Alias /crossdomain.xml /var/www/html/crossdomain.xml
        # proxy pass to the jboss server
        <IfModule mod_proxy.c>
        ProxyRequests Off
        <Proxy *>
            Order deny,allow
            Deny from all
            Allow from all
        </Proxy>
        ProxyPass /Stylect http://127.0.0.1:8081/Stylect
        ProxyPassReverse /Stylect http://127.0.0.1:8081/Stylect
        # ProxyPreserveHost on
        </IfModule>
    </VirtualHost>
    The crossdomain.xml file is at the root of the server and can be accessed with www.mydomain.com/crossdomain.xml
    <cross-domain-policy>
    <site-control permitted-cross-domain-policies="master-only"/>
    <allow-access-from domain="*" to-ports="*" secure="false"/>
    <allow-http-request-headers-from domain="*" headers="*"/>
    </cross-domain-policy>
    I can see in firebug that it's being downloaded when I first request the page - this is the response:
    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
       "http://www.w3.org/TR/html4/strict.dtd">
    <html>
    <head>
      <title>Software as a Service Development. </title>
      <META name="description" content="Description here"><META name="keywords" content="Saas, fashion design, plm, production, nutrition, food, orders">
    </head>
    <frameset rows="100%,*" border="0">
      <frame src="http://xxx.xxx.xxx.xx/crossdomain.xml" frameborder="0" />
      <frame frameborder="0" noresize />
    </frameset>
    <!-- pageok -->
    <!-- 04 -->
    <!-- -->
    </html>
    Yet I still get a 2048 sandbox violation error.
    The crossdomain is needed because the proxied request
    appears to be coming from the public ip while jboss
    is bound to the local host.
    If I expose Jboss directly to the web all works well but there
    are too many security issues in that setup. Apache as a front is
    much better.
    The question is: is this the correct response I should be getting
    (or should it be directly the xml file) and why is it not working?
    How can I fix this?
    Any help much appreciated. I'm stuck.
    Dahn 

    Try adding security="false" inside the next line:
    <allow-access-from domain="*"/>
    so it would look something like
    <allow-access-from domain="*" security="false" />
    It fixed the problem for me.

  • Crossdomain.xml Not Working

    Ok, so first off, my environment. I'm working on a flash
    application that resides on the web server (192.168.1.74) and the
    data its pulling is from a device (192.168.1.77).
    On .77 I have a crossdomain.xml. I have attached the
    crossdomain.xml file.
    The problem I'm having is that while watching the data
    communication in a network sniffer, after the GET for
    /crossdomain.xml happens, about 75% of the time, nothing gets
    returned. When the XML file DOES get returned, there's a HTTP OK
    message... and then that's it. None of the communication between
    the app and the server happens.
    Now, when I run this application in the Flash developer
    program thing, it works fine (I'm on .64) so I know the flash code
    works. So its either a Browser issue or my crossdomain.xml file is
    wrong in some way.

    Try adding security="false" inside the next line:
    <allow-access-from domain="*"/>
    so it would look something like
    <allow-access-from domain="*" security="false" />
    It fixed the problem for me.

  • Question: crossdomain.xml without web server

    Hi, Flex Gurus,
    In case where I want to use Flex to communicate with a
    non-web server machine, e.g. mysql, where should the
    crossdomain.xml reside on the non-web server machine?
    thanks,
    sw

    Well at that point you would put it where ever Flex can load
    the file locally and do Security.loadPolicyFile("url"). However if
    you are going to be using a socket for the connection I'm pretty
    sure crossdomain.xml isn't what you're looking for, with the recent
    security changes to the Flash Player I think you are looking more
    for a Socket Policy File. You can read up on what I'm talking about
    here at the following link.
    Policy
    File

  • Where to place crossdomain.xml

    Hi experts,
    I am trying to connect from a flex application to a webservice on the Web AS. If I deploy local or run the application on the same domain as the webservice everything works fine, but not on another domain, so I think it could be fixed with the crossdomain.xml file on the Web AS. But where should I place this file if my wsdl for the webservice is located at http://<server>:<port>/sap/bc/soap/wsdl11?services=<servicename>??
    Thanks a lot,
    Manfred

    For issues regarding crossdomain.xml be sure to understand the concepts behind it.
    http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html
    Also check http://www.adobe.com/devnet/flashplayer/articles/fplayer9_security.html for changes in latest Flash Player versions.
    You can check if your problems really are caused by crossdomain.xml by using the debug version of the latest Flash Player. This is also described in the above document on [page 5|http://www.adobe.com/devnet/flashplayer/articles/fplayer9_security_05.html].
    Kind regards,
    Roland

  • Please HELP with CrossDomain.xml problem

    I'm using Flex2 with Java as the backend. On my local machine
    everything works fine. When I deployed the Java war file to the
    hosting server and moved the swf there as well I keep getting the
    following error "Security error accessing url"
    faultCode="Channel.Security.Error". After reading on this it says I
    need a crossdomain.xml file put at the root of my server.
    I have placed a crossdomain.xml file at the following areas.
    C:\Inetpub\wwwroot\crossdomain.xml
    C:\Inetpub\vhosts\mysite.com\crossdomain.xml
    C:\Inetpub\vhosts\mysite.com\httpdocs\crossdomain.xml
    C:\Program
    Files\SWsoft\Plesk\Additional\Tomcat\webapps\crossdomain.xml
    the following is in the crossdomain.xml
    <?xml version="1.0"?>
    <!DOCTYPE cross-domain-policy SYSTEM "
    http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
    <cross-domain-policy>
    <allow-access-from domain="*" to-ports="*" secure="true"
    />
    </cross-domain-policy>
    the war file is deployed here:
    C:\Program
    Files\SWsoft\Plesk\Additional\Tomcat\psa-webapps\mysite.com\testjava.war
    and the swf file is located here:
    C:\Inetpub\vhosts\mysite.com\httpdocs\test.swf
    I don't know what I'm missing. Please someone help me.

    daperk,
    You should post this to board "Smartphones, Nseries and Eseries Devices".

  • Flash security issue; Error #2170, crossdomain.xml

    Hi,
    we are using Xcelsius 2008, SP3, together with BO XI 3.1 SP2 (Edge; Linux) and SAP BW.
    We have build a dashboard using Query as a Web Service as datasource (pointing to a SAP BW query).
    When we export the Xcelsius file to the BO repository and run the file from InfoView (or CMC), we get a #2170 error.
    The resolution seems to create a crossdomain.xml file so that Flash Player doesn't block the execution of the file any more.
    Do I have to place this crossdomain.xml file on Tomcat (BO) or SAP BW (transaction SICF)? Are there other solutions for this problem?
    Thanks!

    1. Look for crossdomain.xml in the following folder <BOBJ installation directory>/Tomcat/webapps/ROOT, if it is not there create one.
    2. The content of crossdomain.xml should look like follow:
    <?xml version=”1.0″?>
    <!DOCTYPE cross-domain-policy SYSTEM “http://www.adobe.com/xml/dtds/cross-domain-policy.dtd”>
    <cross-domain-policy>
    <allow-access-from domain=”*” secure=”false” to-ports=”*”/>
    <allow-http-request-headers-from domain=”*” headers=”*”/>
    </cross-domain-policy>
    3. Then restart the Tomcat server
    Reference quoted

  • Problems Accessing Crossdomain.xml

    Ok, so ive been searching for a solution to my problem for 3 days now with no avail... hopefully someone here can help.
    Im building a website that i want to allow users to post jobs with or without an attached file...
    here is the site.... http://soengjobopp.dyndns.org/
    If you go to the POSTAJOB section at the bottom, fill in some test information, click attach to select a file from your machine, press and press submit you will see the error i get... ERROR 2049! (The file wont be attempted to upload until the form has valid data)
    I have a crossdomain policy on my root directory.....  http://soengjobopp.dyndns.org/crossdomain.xml
    Everything works fine when im testing it on my localhost, but when i try to upload from a machine elsewhere i get an error....
    Ive used Firebug(firefox plugin) to monitor the network when im at a client machine and it shows that the crossdomain.xml is trying to be downloaded from http://localhost/crossdomain.xml... i have no idea why... i allow administrators to download file from specific jobs and everything works fine... its just when i want to upload files i get an error... would anyone know why the site would try to get crossdomain.xml from its own local host and not from  http://soengjobopp.dyndns.org/crossdomain.xml ?
    Ive tried the "recompile with network monitor disabled" trick and i have the same problem.
    Ive also tried the Security.loadPolicyFile("http://soengjobopp.dyndns.org/crossdomain.xml ") and it still tries to get its policy file from localhost...
    If anyone could help it would be greatly apprecieated...
    Thanks!

    Hi Rich,
    I followed the steps in your video when our system was R/3 4.7 (WAS 6.20) and the test worked fine, i.e. accessing the crossdomain by typing http://server:port/crossdomain.xml.
    I followed the same steps with our new version (we're undergoing an upgrade) but I kept getting the error message:
    "BSP Exception: the BSP URL /crossdomain.xml Does Not Contain Any Application Entries".  Then I saw Ivan post suggesting implementing OSS Note 1260386.  I applied the Note but I got the same error message. 
    Then I ran function ICFBUFFER_INIT to make sure the buffer is cleared, cleared the cache in the browser and still got the same error message.
    Our system is ERP 6.0, NetWeaver 7.0, level 17 (BASIS Component is SAPKB70017).
    Please help.  Thank you.
    Achille.

  • Httpservice to localhost doesn't work in Flex4... Even with crossdomain.xml

    So, this was working before I recompiled with Flex4, (In Flex 3.5) and now I can't get the following to work....
    Story:
    I'm using httpservice in flex like:
    <mx:HTTPService id="getConfig" url="http://localhost/parser.php" method="POST" showBusyCursor="true" resultFormat="e4x" result="xmlresultHandler(event)" fault="faultHandler(event)" />
    Everything is in my root directory on my web server. When run in debug or directly from flashbuilder, the call works fine. If I run a release build, and FTP the release to /var/www (my root), and try to browse to the server, the website pulls up, and the swf file runs, but I always get a
    Fault:Channel.Security.Error
    FaultString:'Security error accessing url'
    faultDetail:'Destination:DefaultHTTP'
    when it trys to read the httpservice.
    I do have a crossdomain.xml file in my /var/www (webroot) folder with what I see as super permissive settings.... Below:
    <?xml version="1.0"?>
    <!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
    <cross-domain-policy>
    <allow-access-from domain="*" to-ports="*" />
    <site-control permitted-cross-domain-policies="all" />
    <allow-http-request-headers-from domain="*" headers="*" />
    </cross-domain-policy>
    Any help would be GREATLY appreciated.

    Thanks for the info Flex harUI,
    So I tried bringing up the 3 files (crossdomain.xml, main.swf, and parser.php) from a browser and they call exist and are reachable.
    So I get the localhost vs. absolute address this. That makes sense. So I recoded the httpservice call to url="http://10.101.50.60/parser.php". Which is the actual fully qualified address in this case (There is no DNS server), and what I'm pulling up in the browser is "http://10.101.50.60/index.html". So after making this change, I can still access and have everything working in Flash builder, but again, when I standalone compile and upload the main.swf to the var/www directory and pull it up in the browser via http://10.101.50.60/main.swf. I get "Security error accessing URL". So basiclly, same thing.
    Spent two days on it now.....

  • Crossdomain.xml issue - Accessing SAP from adobe FLEX

    Hi All,
    We are in the process of trying to integrate 4 SAP bapis exposed as Web services from adobe flex.
    When we do so we are getting a "security error accessing URL"
    The URL of our flex application is:
    http://10.10.0.48:8081/water0305/iden.html
    The WSDL of the web service is:
    http://10.10.0.66:8001/sap/bc/srt/rfc/sap/ZKK_BAPI_EQMT_DETAIL?sap-client=800&wsdl=1.1
    We looked at various forums and we found that adding a crossdomain.xml file to the root directory
    (at the destination server) will resolve the issue.
    I did implement all those steps on the R/3 side to add a crossdomain.xml to an ABAP WAS.
    crossdomain.xml on WAS
    however i still get those errors(security error accessing URL).
    Below is the code i use to access the SAP web service
    <mx:WebService
    id="EqmtDetailWS" showBusyCursor="true" fault="Alert.show(event.fault.faultString)" >
    <mx:operation name="EqmtDetail" resultFormat="e4x" result="getEquip_result(event);" fault="getFault(event);">
    <mx:request>
    <Equipment></Equipment>
    </mx:request>
    </mx:operation>
    </mx:WebService>
    We are  displaying the SAP info on a map service provided by esri so we included the load operation here.
    <-Loading the wsdl->
    private
    function onExtentChange(event:ExtentEvent):void {
    EqmtDetailWS.wsdl=
    "http://10.10.0.66:8001/sap/bc/srt/rfc/sap/ZKK_BAPI_EQMT_DETAIL?sap-client=800&wsdl=1.1&sap-user=******&sap-password=****&sap-language=EN&~transaction=iw51";
    EqmtDetailWS.loadWSDL();
    <Displaying the info from SAP>
    private function getEquip_result(event:ResultEvent):void {
    equip_desc = event.result.Equitext.Equidescr;
    txtAreaEquipDetail.htmlText = txtAreaEquipDetail.htmlText + "Equi. Desc. : " + event.result.Equitext.Equidescr + "\n";
    var material:String=event.result.Equimaster.Material;
    SAPIDAliasEquipDesc =event.result.Equitext.Equidescr;
    material=material.substring(14,18);
    txtAreaEquipDetail.htmlText = txtAreaEquipDetail.htmlText + "Material : " + material + "\n";
    txtAreaEquipDetail.htmlText = txtAreaEquipDetail.htmlText + "Serial No : " + event.result.Equimaster.Serialno + "\n";
    var costcntr:String=event.result.Equilocation.Costcenter;
    costcntr=costcntr.substring(7,10);
    txtAreaEquipDetail.htmlText = txtAreaEquipDetail.htmlText + "Cost Center : " + costcntr + "\n";
    CustomerID = event.result.Equisales.Customer;
    This is how we load the policy file.
    Security.loadPolicyFile(
    http://10.10.0.66:8001/sap/bc/bsp/sap/zroot/crossdomain.xml);
    This works fine when we run it from the IDE but throws up an error when we deploy it on the server
    So are we missing something ?
    Is there anything else to be done to overcome the security issue ?
    Thanks in advance.
    Regards,
    Karthik.

    Hi Rich,
    I followed the steps in your video when our system was R/3 4.7 (WAS 6.20) and the test worked fine, i.e. accessing the crossdomain by typing http://server:port/crossdomain.xml.
    I followed the same steps with our new version (we're undergoing an upgrade) but I kept getting the error message:
    "BSP Exception: the BSP URL /crossdomain.xml Does Not Contain Any Application Entries".  Then I saw Ivan post suggesting implementing OSS Note 1260386.  I applied the Note but I got the same error message. 
    Then I ran function ICFBUFFER_INIT to make sure the buffer is cleared, cleared the cache in the browser and still got the same error message.
    Our system is ERP 6.0, NetWeaver 7.0, level 17 (BASIS Component is SAPKB70017).
    Please help.  Thank you.
    Achille.

  • Crossdomain.xml with Flash player 9.0.115.0

    Hi gurus,
    I have just spent the best part of a day wading through the
    new security features of Flash Player 9.0.115.0. I use flash.socket
    library, so I have discovered that error message I've been getting
    will get worse, ie., next version of the Flash Player may not even
    connect. So I got the good oil from
    here.
    I have written a crossdomain.xml file that looks like this
    (it's in the www root):
    <?xml version="1.0"?>
    <cross-domain-policy>
    <site-control
    permitted-cross-domain-policies="master-only"/>
    <allow-access-from domain="192.168.5.201"
    to-ports="7700"/>
    </cross-domain-policy>
    Problem is that the flash player adds the follwing line to
    the \Logs\policyFiles.txt it generates:
    Warning: Domain 192.168.5.201 does not specify a meta-policy.
    Applying default meta-policy 'all'. This configuration is
    deprecated. See
    http://www.adobe.com/go/strict_policy_files
    to fix this problem.
    From my reading I have specified a meta-policy with the line:
    <site-control
    permitted-cross-domain-policies="master-only"/>
    So my question is why can't it find the meta-policy?

    kcell,
    thanks for the reply. Actually you are a bit ahead of me. I
    have a single web-server and I'm not actually trying to cross
    domains! However, the security advice says (page 4 of the link I
    gave in my original post)
    "A URL policy file authorizes data loading from its own HTTP,
    HTTPS, or FTP server, whereas a socket policy file authorizes
    socket connections to its own host."
    So because I'm using a socket connection I still need a
    crossdomain.xml. For this sockect connection I am going to open up
    port 843 (as Adobe recommends) on my web-server for this policy to
    be loaded when calling flash.socket.connect(...).
    However, that isn't actually my problem. What I've also done,
    I think, is added a line to my crossdomain.xml file that will
    define a meta-policy, to prevent clients from other domains
    accessing my server (also recommended by Adobe). The line is:
    <site-control
    permitted-cross-domain-policies="master-only"/>, but I don't
    think my SWF is reading the file because I get that error message:
    Warning: Domain 192.168.5.201 does not specify a meta-policy.
    Applying default meta-policy 'all'. This configuration is
    deprecated. See
    http://www.adobe.com/go/strict_policy_files
    to fix this problem.
    Sory about the excessive waffle!

  • Multiple plugtmp-1 plugtmp-2 etc. in local\temp folder stay , crossdomain.xml and other files containing visited websitenames created while private browsing

    OS = Windows 7
    When I visit a site like youtube whith private browsing enabled and with the add-on named "shockwave flash" in firefox add-on list installed and activate the flashplayer by going to a video the following files are created in the folder C:\Users\MyUserName\AppData\Local\Temp\plugtmp-1
    plugin-crossdomain.xml
    plugin-strings-nl_NL-vflLqJ7vu.xlb
    The contents of plugin-crossdomain contain both the "youtube.com" adress as "s.ytimg.com" and is as follows:
    <?xml version="1.0"?>
    <!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
    -<cross-domain-policy> <allow-access-from domain="s.ytimg.com"/> <allow-access-from domain="*.youtube.com"/> </cross-domain-policy>
    The contents of the other file I will spare you cause I think those are less common when I visit other sites but I certainly don't trust the file. The crossdomain.xml I see when I visit most other flashpayer sites as well.
    I've also noticed multiple plugin-crossdomain-1.xml and onwards in numbers, I just clicked a youtube video to test, got 6 of them in my temp plus a file named "plugin-read2" (no more NL file cause I changed my country, don't know how youtube knows where I'm from, but that's another subject, don't like that either). I just noticed one with a different code:
    <?xml version="1.0"?>
    -<cross-domain-policy> <allow-access-from domain="*"/> </cross-domain-policy>
    So I guess this one comprimises my browsing history a bit less since it doesn't contain a webadress. If these files are even meant to be deposited in my local\temp folder. The bigger problem occurs when they stay there even after using private browsing, after clearing history, after clearing internet temporary files, cache, whatever you can think of. Which they do in my case, got more than 50 plugtmp-# folders in the previous mentioned local\temp folder containing all website names I visited in the last months. There are a variety of files in them, mostly ASP and XML, some just say file. I have yet to witness such a duplicate folder creation since I started checking my temp (perhaps when firefox crashes? I'd say I've had about 50 crashes in recent months).
    I started checking my temp because of the following Microsoft Security Essential warnings I received on 23-4-12:
    Exploit:Java/CVE-2010-0840.HE
    containerfile:C:\Users\Username\AppData\Local\Temp\jar_cache2196625541034777730.tmp
    file:C:\Users\Username\AppData\Local\Temp\jar_cache2196625541034777730.tmp->pong/reversi.class
    and...
    Exploit:Java/CVE-2008-5353.ZT
    containerfile:C:\Users\Noname\AppData\Local\Temp\jar_cache1028270176376464057.tmp
    file:C:\Users\Noname\AppData\Local\Temp\jar_cache1028270176376464057.tmp->Testability.class
    Microsoft Security Essentials informed me that these files were quarantained and deleted but when going to my temp file they were still there, I deleted them manually and began the great quest of finding out what the multiple gigabytes of other files and folders were doing in that temp folder and not being deleted with the usual clearing options within firefox (and IE).
    Note that I have set my adobe flasplayer settings to the most private intense I could think of while doing these tests (don't allow data storage for all websites, disable peer-to peer stuff, don't remember exactly anymore, etc.). I found it highly suspicious that i needed to change these settings online on an adobe website, is that correct? When right-clicking a video only limited privacy options are available which is why I tried the website thing.
    After the inital discovery of the java exploit (which was discovered by MSE shortly after I installed and started my first scan with Malwarebytes, which in turn made me suspicious whether I had even downloaded the right malwarebytes, but no indication in the filename if I google it). Malwarebytes found nothing, MSE found nothing after it said it removed the files, yet it didn't remove them, manually scanning these jar_cache files with both malwarevytes and MSE resulted in nothing. Just to be sure, I deleted them anyways like I said earlier. No new jar_cache files have been created, no exploits detected since then. CCleaner has cleaned most of my temp folder, I did the rest, am blocking all cookies (except for now shortly), noscript add-on has been running a while on my firefox (V 3.6.26) to block most javascripts except from sites like youtube. I've had almost the same problem using similar manual solutions a couple of months ago, and a couple of months before that (clearing all the multiple tmp folders, removing or renaming jar_cache manually, running various antmalware software, full scan not finding a thing afterwards, installing extra add-ons to increase my security, this time it's BetterPrivacy which I found through a mozilla firefox https connection, I hope, which showed me nicely how adobe flash was still storing LSO's even after setting all storage settings to 0 kb and such on the adobe website, enabling private browsing in firefox crushed those little trolls, but still plugtmp trolls are being created, help me crush them please, they confuse me when I'm looking for a real threat but I still want to use flash, IE doesn't need those folders and files, or does it store them somewhere else?).
    I'm sorry for the long story and many questions, hope it doesn't scare you away from helping me fight this. I suspect it's people wanting to belong to the hackergroup Anonymous who are doing this to my system and repeating their tricks (or the virus is still there, but I've done many antivirus scans with different programs so no need to suggest that option to me, they don't find it or I run into it after a while again, so far, have not seen jar_cache show up). Obviously, you may focus on the questions pertaining firefox and plugtmp folders, but if you can help me with any information regarding those exploits I would be extremely grateful, I've read alot but there isn't much specific information for checking where it comes from when all the anti-virus scanners don't detect anything anymore and don't block it incoming. I also have downloaded and installed process monitor but it crashes when I try to run it. The first time I tried to run it it lasted the longest, now it crashes after a few seconds, I just saw the number of events run up to almost a million and lots of cpu usage. When it crashed everything returned back to normal, or at least that's what I'm supposed to think I guess. I'll follow up on that one on their forum, but you can tell me if the program is ligit or not (it has a microsoft digital signature, or the name micosoft is used in that signature).

    update:
    I haven't upgraded my firefox yet because of a "TVU Web Player" plugin that isn't supported in the new firefox and I'm using it occasionally, couldn't find an upgrade for it. Most of my other plugins are upgraded in the green (according to mozilla websitechecker):
    Java(TM) Platform SE 6 U31 (green)
    Shockwave for Director (green - from Adobe I think)
    Shockwave Flash (green - why do I even need 2 of these adobe add-ons? can I remove one? I removed everything else i could find except the reader i think, I found AdobeARM and Adobe Acrobat several versions, very confusing with names constantly switching around)
    Java Deployment Toolkit 6.0.310.5 (green, grrr, again a second java, why do they do this stuff, to annoy people who are plagued with java and flash exploits? make it more complicating?)
    Adobe Acrobat (green, great, it's still there, well I guess this is the reader then)
    TVU Web Player for FireFox (grey - mentioned it already)
    Silverlight Plug-In (yellow - hardly use it, I think, unless it's automatic without my knowing, perhaps I watched one stream with it once, I'd like to remove it, but just in case I need it, don't remember why I didn't update, perhaps a conflict, perhaps because I don't use it, or it didn't report a threat like java and doesn't create unwantend and history compromising temp files)
    Google Update (grey - can I remove? what will i lose? don't remember installing it, and if I didn't, why didn't firefox block it?)
    Veetle TV Core (grey)
    Veetle TV Player (grey - using this for watching streams on veetle.com, probably needs the Core, deleted the broadcaster that was there earlier, never chose to install that, can't firefox regulate that when installing different components? or did i just miss that option and assumed I needed when I was installing veetle add-on?)
    Well, that's the list i get when checking on your site, when i use my own browseroptions to check add-ons I get a slightly different and longer list including a few I have already turned off (which also doesn't seem very secure to me, what's the point in using your site then for anything other than updates?), here are the differences in MY list:
    I can see 2 versions of Java(TM) Platform SE 6 U31, (thanks firefox for not being able to copy-paste this)
    one "Classic Java plug-in for Netscape and Mozilla"
    the other is "next generation plug-in for Mozilla browsers".
    I think I'll just turn off the Netscape and Mozilla one, don't trust it, why would I need 2? There I did it, no crashes, screw java :P
    There's also a Mozilla Default plugin listed there, why does firefox list it there without any further information whether I need it or not or whether it really originates from Mozilla firefox? It doesn't even show up when I use your website plugin checker, so is there no easy way by watching this list for me to determin I can skip worrying about it?
    There's also some old ones that I recently deactivated still listed like windows live photo gallery, never remember adding that one either or needing it for anything and as usual, right-clicking and "visit homepage" is greyed out, just as it is for the many java crap add-ons I encountered so far.
    Doing a quick check, the only homepage I can visit is the veetle one. The rest are greyed out. I also have several "Java Console" in my extentions tab, I deactivated all but the one with the highest number. Still no Java Console visible though, even after going to start/search "java", clicking java file and changing the settings there to "show" console instead of "hide" (can't remember exact details).
    There's some other extentions from noscript, TVU webplayer again, ADblock Plus and now also BetterPrivacy (sidenote, a default.LSO remains after cleanup correct? How do I know that one isn't doing anything nasty if it's code has been changed or is being changed? To prevent other LSO's I need to use both private browsing and change all kinds of restrictions online for adobe flashplayer, can anyone say absurd!!! if you think you're infected and want to improve your security? Sorry that rant was against Adobe, but it's really against Anonymous, no offense).

  • #2170 error calling a webservice from Xcelsius having crossdomain.xml

    Hello together,
    we are facing a #2170 error indicating we don't have a proper policy file in place when executing a published Xcelsius flash in SAP BI application portal.
    We created a WebService that is running an SAP BI System 7.01. The WebService is function module based and was generated following the wizzard. Afterwards we created a Xcelsius app that consumes data from this WebService (via data connection). The resulting flash from Xcelsius was pulished to SAP BI System (portal).
    Since there are many entries in the SDN and the internet in general we finally also created an crossdomain.xml file on the BI system which can be accessed and is visible by using "https://<server>/crossdomain.xml".
    Now the confusion begins: We exported the flash from Xcelsius to local desktop and executed the corresponding HTML-file. It's working and I can receive/see WebService data (after adjusting flash-security-settings). If we upload both exported files (html and swf) to the BI system (as MIME objects) and execute the html again we are also receiving WebServervice data. So far so good. But if we execute the link from the SAP BI Portal (Xcelsius menu > SAP > Start) we still get the error #2170 indicating we don't have a proper domain policy file in place. But for my understanding we do have. So currently I would assume the error message is somehow misleading.
    During all the activities I found out that this error is also raised if the user has insufficient authorization. My user has SAP_ALL authorization for testing purpose.
    In general I would say we are not that wrong with our Xcelsius/WebService if we are not coming from BI portal. So my questions are:
    1.) Are there any authorization on portal side that might not fit and lead to this error? If insufficient authorizations produces such an error ...
    2.) Did we miss any other stuff during our try/fail-operations?
    Many thanks in advance for your hints.
    Steffen

    Hi Rajat,
    This is how the default trace looks
    FATAL: Application Servlet failed to notify devices.
    Caught java.rmi.RemoteException: Service call exception; nested exception is:
         com.sap.engine.services.webservices.jaxrpc.exceptions.InvalidResponseCodeException: Invalid Response Code: (503) Service Unavailable. The requested URL was:"http://<<server>>:50000/ManagementService/ManagementService?style=document"
         at com.om.mws.standaloneproxy.ManagementServiceBindingStub.notifyDevice(ManagementServiceBindingStub.java:1289)
         at com.om.mws.standaloneproxy.ManagementServiceBindingStub.notifyDevice(ManagementServiceBindingStub.java:1298)
         at com.om.ApplicationServlet$NotifyDevices.run(ApplicationServlet.java:86)
    Caused by: com.sap.engine.services.webservices.jaxrpc.exceptions.InvalidResponseCodeException: Invalid Response Code: (503) Service Unavailable. The requested URL was:"http://<<server>>:50000/ManagementService/ManagementService?style=document"
         at com.sap.engine.services.webservices.jaxrpc.wsdl2java.soapbinding.MimeHttpBinding.handleResponseMessage(MimeHttpBinding.java:980)
         at com.sap.engine.services.webservices.jaxrpc.wsdl2java.soapbinding.MimeHttpBinding.call(MimeHttpBinding.java:1430)
         at com.om.mws.standaloneproxy.ManagementServiceBindingStub.notifyDevice(ManagementServiceBindingStub.java:1282)
         ... 2 more
    java.lang.NoSuchMethodError
    at java.lang.Thread.destroy(Thread.java:779)
         at com.omApplicationServlet$NotifyDevices.run(ApplicationServlet.java:92)
    Rgds
    Shashank

Maybe you are looking for

  • Amount on Goods receipt for return orders is wrong with movement type 653

    Hi All, I am sorry if it is a simple question because i am an abap'er. My requirement is to create return sales order (with ref.to Billing document) and deliver and PGI for the return orders. This should go to sales order stock. Accounting document s

  • Moving avergae price updation in material master for project stock

    Dear All, My query is pertaining to updation of MAP( moving average price) for project specific procurement ( as project stock) for valuated project stock. As  definelty the cost of procurement gets consumed by project .but i want to know does the pr

  • Music Has No Folder

    When I try to sync my music to ipod it says "cannot be synced because the playlists selected for syncing no longer exist" This is really annoying me.

  • UDF Required for checking input value.

    Hi,      I'm in need of an UDF for checking the input value and pass constant based on that. Requirement.                     We are having 1 field on the source side which need to be checked.                     If the first character of the input i

  • JavaFX Tree with Drag n Drop functionality

    Hi I was trying to build a tree in JavaFX where the all the nodes of the tree will be draggable and droppable. Could anyone show me the way to do it or provide one nice example? Thanks Rashed