Re: Windows short (8.3) filenames - a security nightmare?

["Stefan Kanthak" <stefan.kanthak () nexgo de>]

"Bogdan Calin" <bogdan () acunetix com> wrote:

> Hi guys,
>
> I wrote a blog post about security issues related with Windows short (8.3) filenames.
>
> http://www.acunetix.com/blog/web-security-zone/articles/windows-short-8-3-filenames-web-security-problem/

1. tell news

2. since all (but Microsoft) know very well that Windows x64 can't run
   16-bit DOS and Windows 3.x programs any more Microsoft still enables
   8.3 filenames in all versions of Windows ... at least on the system
   drive.

JFTR: Windows Vista and later enforce 8.3 filenames on the system drive.

You can but try to remove them via
    %SystemRoot%\System32\FSUtil.Exe 8Dot3Name Strip ...
(see <http://technet.microsoft.com/en-us/library/ff621566.aspx>)


JFTR2: Windows NT4 and Windows NT5.x don't enforce this stupidity.

You can turn off 8.3 filename creation during setup of Windows NT5.x
via addition of a file

    --- \i386\MIGRATE.INF or \amd64\MIGRATE.INF ---
    [Version]
    Provider  = "Stefan Kanthak"
    Signature = "$Windows NT$"

    [AddReg]
    ; Disable creation of 8.3 DOS filenames (see MSKB 121007 & 210638)
    HKLM,"System\ControlSet001Control\FileSystem","NTFSDisable8dot3NameCreation",65537,1
    --- EOF ---

and modification of the file

    --- \i386\TXTSETUP.SIF or \amd64\TXTSETUP.SIF ---
    ...

    [HiveInfs.Fresh]
  + AddReg = MIGRATE.INF,AddReg

    [HiveInfs.Upgrade]
  + AddReg = MIGRATE.INF,AddReg

    ...
    --- EOF ---


JFTR3: when done, create an empty file "%ProgramFiles%\Shared.exe"
(change the filename according to your language to match
"%CommonProgramFiles%" up to the last space) to see the wonderful
crapware from InstallShield fail.-P

If not, it will fail anyhow, at least during uninstallation or repair.
You can count on Wise installer too.-(

When "%ProgramFiles%" contains a space, create the appropriate file
in %SystemDrive% too.

Yes, more than 17 years after the introduction of long filenames
there a still developers who don't know how to use them properly!


Stefan Kanthak

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/