BlueDragon Server and Server JX 6.2.1.286 for Windows allows remote attackers to cause a denial of service (hang) via a request for a .cfm file whose name contains an MS-DOS device name such as (1) con, (2) aux, (3) com1, and (4) com2.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2006-2311
http://www.vupen.com/english/advisories/2006/2502
http://www.securityfocus.com/bid/18624