Re: Re: [VulnWatch] Microsoft Windows NTFS Information Disclosure

cacls *.chk /G administrator:F
in shared environments where for some reason your users have access to
their drives.

On 6/30/05, Matthew Murphy <[email protected]> wrote:
> Melvin Klassen wrote:
>=20
> >[email protected] (Matthew Murphy) at Jun 30, 2005 12:01:59 PM wrote:
> >
> >
> >
> >>However, an apparent error in the NTFS driver's code causes the file
> >>system to incorrectly assign disk blocks to files before they have been
> >>initialized.  Following a recovery from a system shutdown, uninitialize=
d
> >>data may be visible in files from previously allocated disk blocks.
> >>
> >>
> >
> >As far as I know, _every_ major Operating System has the same vulnerabil=
ity.
> >
> >I do _NOT_ know of any Operating System that "zero's" each newly-allocat=
ed
> >block/sector/track/cylinder of disk-space when allocating a "new" file,
> >whether on disk, or on magnetic tape, or on removable media.
> >
> >  IBM AIX?    No.
> >  IBM z/VM?   No.
> >  IBM z/OS?   No.
> >  IBM OS/2?   No.
> >  HP/UX?      No.
> >  Linux?      No.
> >  MS DOS?     No.
> >  MS Windows? No.
> >
> >
> I wrote a more detailed reply to Melvin off-list.  This response misses
> the point of the issue... which is not the fact that uninitialized data
> exists on disk (a known fact exploited by everything from "Delete undo"
> tools to forensic software), but that the NTFS accounting code treats
> said data as a valid portion of the file's content, thus making it
> readable to users without privileged access to the system.
>=20
> VulnWatch Mod Note: Moved to VulnDiscuss, as I feel this to be the more
> sensible forum of discussion.  You may want to move the original
> response there as well, to avoid confusion.
>=20
>=20
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>=20
>=20
>
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/