Re: [VulnWatch] Microsoft Windows NTFS Information Disclosure

This is a cryptographically signed message in MIME format.

--===============0186851395==
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature";
	micalg=sha1; boundary="------------ms090200030607000409040609"

This is a cryptographically signed message in MIME format.

--------------ms090200030607000409040609
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Melvin Klassen wrote:

>[email protected] (Matthew Murphy) at Jun 30, 2005 12:01:59 PM wrote:
>
>  
>
>>However, an apparent error in the NTFS driver's code causes the file 
>>system to incorrectly assign disk blocks to files before they have been 
>>initialized.  Following a recovery from a system shutdown, uninitialized 
>>data may be visible in files from previously allocated disk blocks.
>>    
>>
>
>As far as I know, _every_ major Operating System has the same vulnerability.
>
>I do _NOT_ know of any Operating System that "zero's" each newly-allocated
>block/sector/track/cylinder of disk-space when allocating a "new" file,
>whether on disk, or on magnetic tape, or on removable media.
>
>  IBM AIX?    No.
>  IBM z/VM?   No.
>  IBM z/OS?   No.
>  IBM OS/2?   No.
>  HP/UX?      No.
>  Linux?      No.
>  MS DOS?     No.
>  MS Windows? No.
>  
>
I wrote a more detailed reply to Melvin off-list.  This response misses 
the point of the issue... which is not the fact that uninitialized data 
exists on disk (a known fact exploited by everything from "Delete undo" 
tools to forensic software), but that the NTFS accounting code treats 
said data as a valid portion of the file's content, thus making it 
readable to users without privileged access to the system.

VulnWatch Mod Note: Moved to VulnDiscuss, as I feel this to be the more 
sensible forum of discussion.  You may want to move the original 
response there as well, to avoid confusion.

--------------ms090200030607000409040609
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIH7TCC
AlEwggG6oAMCAQICAwy7qzANBgkqhkiG9w0BAQQFADBiMQswCQYDVQQGEwJaQTElMCMGA1UE
ChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNv
bmFsIEZyZWVtYWlsIElzc3VpbmcgQ0EwHhcNMDQwNzIyMDIwNjM1WhcNMDUwNzIyMDIwNjM1
WjBGMR8wHQYDVQQDExZUaGF3dGUgRnJlZW1haWwgTWVtYmVyMSMwIQYJKoZIhvcNAQkBFhRt
YXR0bXVycGh5QGtjLnJyLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAupiGWjG1
i2f5iTXU6pHEMirw6Ng11plyt41rN3Tjo8cm3U2eeiPnaYG/272N77nGHrnVyrhWXQWTIFJY
yrv52OJs2PYAZyje9Dj0+EIYjzNBx+dNfqPXP5LMYzbaDTWOVgZk+d+z+gTkwsGWeNFoPj9s
R1fcV10wNUjfsuXa1tkCAwEAAaMxMC8wHwYDVR0RBBgwFoEUbWF0dG11cnBoeUBrYy5yci5j
b20wDAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQQFAAOBgQCGjybEkwcNXlT47VHA1csUihzg
XAERdcqlXZyg38nfr6LKJ3SCszgJflcG3SKUZlmjnTs3f66z6wENVWWEkmTbWcIbwJYSQxC0
LmU1NYqZkwbEi7dWA1YDhAN+icvHiffeBrFNphLzqSKpFomzyc00vtQZ6dK7rKxZuB1k7jJj
wjCCAlEwggG6oAMCAQICAwy7qzANBgkqhkiG9w0BAQQFADBiMQswCQYDVQQGEwJaQTElMCMG
A1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBl
cnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0EwHhcNMDQwNzIyMDIwNjM1WhcNMDUwNzIyMDIw
NjM1WjBGMR8wHQYDVQQDExZUaGF3dGUgRnJlZW1haWwgTWVtYmVyMSMwIQYJKoZIhvcNAQkB
FhRtYXR0bXVycGh5QGtjLnJyLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAupiG
WjG1i2f5iTXU6pHEMirw6Ng11plyt41rN3Tjo8cm3U2eeiPnaYG/272N77nGHrnVyrhWXQWT
IFJYyrv52OJs2PYAZyje9Dj0+EIYjzNBx+dNfqPXP5LMYzbaDTWOVgZk+d+z+gTkwsGWeNFo
Pj9sR1fcV10wNUjfsuXa1tkCAwEAAaMxMC8wHwYDVR0RBBgwFoEUbWF0dG11cnBoeUBrYy5y
ci5jb20wDAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQQFAAOBgQCGjybEkwcNXlT47VHA1csU
ihzgXAERdcqlXZyg38nfr6LKJ3SCszgJflcG3SKUZlmjnTs3f66z6wENVWWEkmTbWcIbwJYS
QxC0LmU1NYqZkwbEi7dWA1YDhAN+icvHiffeBrFNphLzqSKpFomzyc00vtQZ6dK7rKxZuB1k
7jJjwjCCAz8wggKooAMCAQICAQ0wDQYJKoZIhvcNAQEFBQAwgdExCzAJBgNVBAYTAlpBMRUw
EwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQBgNVBAcTCUNhcGUgVG93bjEaMBgGA1UEChMRVGhh
d3RlIENvbnN1bHRpbmcxKDAmBgNVBAsTH0NlcnRpZmljYXRpb24gU2VydmljZXMgRGl2aXNp
b24xJDAiBgNVBAMTG1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBDQTErMCkGCSqGSIb3DQEJ
ARYccGVyc29uYWwtZnJlZW1haWxAdGhhd3RlLmNvbTAeFw0wMzA3MTcwMDAwMDBaFw0xMzA3
MTYyMzU5NTlaMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3dGUgQ29uc3VsdGluZyAo
UHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgSXNzdWluZyBD
QTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAxKY8VXNV+065yplaHmjAdQRwnd/p/6Me
7L3N9VvyGna9fww6YfK/Uc4B1OVQCjDXAmNaLIkVcI7dyfArhVqqP3FWy688Cwfn8R+RNiQq
E88r1fOCdz0Dviv+uxg+B79AgAJk16emu59l0cUqVIUPSAR/p7bRPGEEQB5kGXJgt/sCAwEA
AaOBlDCBkTASBgNVHRMBAf8ECDAGAQH/AgEAMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9j
cmwudGhhd3RlLmNvbS9UaGF3dGVQZXJzb25hbEZyZWVtYWlsQ0EuY3JsMAsGA1UdDwQEAwIB
BjApBgNVHREEIjAgpB4wHDEaMBgGA1UEAxMRUHJpdmF0ZUxhYmVsMi0xMzgwDQYJKoZIhvcN
AQEFBQADgYEASIzRUIPqCy7MDaNmrGcPf6+svsIXoUOWlJ1/TCG4+DYfqi2fNi/A9BxQIJNw
PP2t4WFiw9k6GX6EsZkbAMUaC4J0niVQlGLH2ydxVyWN3amcOY6MIE9lX5Xa9/eH1sYITq72
6jTlEBpbNU1341YheILcIRk13iSx0x1G/11fZU8xggK6MIICtgIBATBpMGIxCzAJBgNVBAYT
AlpBMSUwIwYDVQQKExxUaGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNU
aGF3dGUgUGVyc29uYWwgRnJlZW1haWwgSXNzdWluZyBDQQIDDLurMAkGBSsOAwIaBQCgggGn
MBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTA1MDYzMDIyMTE1
NFowIwYJKoZIhvcNAQkEMRYEFIh1drrUPJ9SdHsGRGUA2xHfuFnrMFIGCSqGSIb3DQEJDzFF
MEMwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIH
MA0GCCqGSIb3DQMCAgEoMHgGCSsGAQQBgjcQBDFrMGkwYjELMAkGA1UEBhMCWkExJTAjBgNV
BAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJz
b25hbCBGcmVlbWFpbCBJc3N1aW5nIENBAgMMu6swegYLKoZIhvcNAQkQAgsxa6BpMGIxCzAJ
BgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYD
VQQDEyNUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgSXNzdWluZyBDQQIDDLurMA0GCSqGSIb3
DQEBAQUABIGAuBLdrUgDX+TNRyrc29xmNYFaJaq5C5ZEPlWOOIDz+qJO6jsDTBOGB87Ou2+8
dl7bBQ6zan7zC7pdt0VHpxBprLWEiuOWTBLOYaB1WvwXRzuVX2S7bIRt2uCzALgyD8IqltB/
MvE8rXH4iZFPYhENco/yp6o7trIaizTY2LapbjwAAAAAAAA=
--------------ms090200030607000409040609--

--===============0186851395==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
--===============0186851395==--