Bugtraq mailing list archives
Re: CERT Advisory CA-98.04 - NT.WebServers
From: dleblanc () MINDSPRING COM (David LeBlanc)
Date: Fri, 6 Feb 1998 16:30:30 -0500
At 05:56 PM 2/6/98 -0500, you wrote:
-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= CERT* Advisory CA-98.04 Original issue date: Feb. 06, 1998 Last revised: -- Topic: Microsoft Windows-based Web Servers unauthorized access - long file names
-
----------------------------------------------------------------------------
B. Until you are able to install the appropriate patch, we recommend
the
following workaround. (1) Use only 8.3-compliant short file names for the files that you want to have protected solely by the web server. (2) Use NTFS-based ACLs (directory or file level access control lists) to augment or replace web server-based security. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
There is another work-around, which is much less trouble and retains more of the capabilities of your web site. If you are not using any 16-bit applications, then you can turn off 8.3 filename generation. The method to use would be to: 1) Open the registry editor [insert standard warnings about not nuking the registry here]. 2) Navigate to: Registry path: HKEY_LOCAL_MACHINE\System \CurrentControlSet \Control \FileSystem 3) Create a value named: NtfsDisable8dot3NameCreation, type REG_DWORD, and set it to 1. 4) Reboot your system. It will no longer create new 8.3 filenames. 5) Use scopy (to preserve your permissions) to copy your web site to another part of the drive. Once you have verified it is correctly copied, erase the existing files, and copy it back. The new files and directories will not contain a 8.3 filename, and will not be available to this exploit. David LeBlanc |Why would you want to have your desktop user, dleblanc () mindspring com |your mere mortals, messing around with a 32-bit |minicomputer-class computing environment? |Scott McNealy
Current thread:
- Windows 95 Serv-U FTP bug whiz (Feb 04)
- <Possible follow-ups>
- Re: Windows 95 Serv-U FTP bug tl (Feb 05)
- Re: Windows 95 Serv-U FTP bug Alan Thew (Feb 06)
- SMB signing NT chall / response Mudgenski Von Splat (Feb 06)
- L0pht Advisory - NT port binding vulnerability Weld Pond (Feb 06)
- An update on MS private key (in)security issues Aleph One (Feb 06)
- Another ld-linux.so problem Solar Designer (Feb 06)
- CERT Advisory CA-98.04 - NT.WebServers Phillip R. Jaenke (Feb 06)
- Re: CERT Advisory CA-98.04 - NT.WebServers David LeBlanc (Feb 06)
- serious security hole in KDE Beta 3 Tudor Bosman (Feb 06)
- Re: Another ld-linux.so problem joost witteveen (Feb 07)
- Re: Another ld-linux.so problem Solar Designer (Feb 07)
- Re: Another ld-linux.so problem carson () tla org (Feb 07)
- Re: Another ld-linux.so problem Aleph One (Feb 08)
- www-sql cgi prog overrides .htaccess restrictions. Mr LEROY christophe (Feb 09)
- Re: www-sql cgi prog overrides .htaccess restrictions. Stunt Pope (Feb 09)
- SNI-24: IDS Vulnerabilities Secure Networks Inc. (Feb 09)
- AIX/Gradient iFOR/LS bug: follows symlinks Joerg Schumacher (Feb 09)
- Re: AIX/Gradient iFOR/LS bug: follows symlinks Troy A. Bollinger (Feb 09)