Security Incidents mailing list archives

Re: Anonymous FTP annoyance


From: "Nick FitzGerald" <nick () virus-l demon co uk>
Date: Sun, 9 Dec 2001 21:47:53 +1200

"Bryan Smith" <bryan () theclerk com> wrote:

Also, now that I would like to clean this up, I find that I cannot
delete the folder "com1".  No ACL information is found in the properties
for the directory and it's not read-only.  Somehow the tool created a
"permanent" folder.

The real "problem" here is that the directory name matches a device 
pseudo-filename.  In theory, such names cannot be used for real file, 
and hence directory, names.  In reality -- well, you've seen the 
evidence with your own eyes...

What can be done to clean this up?

The Posix file utilities are reputed to deal with such files and 
folders (are they still shipped with Win2K?) and, depending on the 
actual filename and the version of the OS you may find that the 
humble "?" (but not "*") wildcard works with the standard Windows 
commandline tools.

Also note that the filename may *not* be the apparent (illegal) 
"com1" but something like "com1" followed by one or more invisible 
characters such as space, FFh, etc.


-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com


Current thread: