Improper Handling of Windows ::DATA Alternate Data Stream

Opis

The product does not properly prevent access to, or detect usage of, alternate data streams (ADS).

An attacker can use an ADS to hide information about a file (e.g. size, the name of the process) from a system or file browser tools such as Windows Explorer and 'dir' at the command line utility. Alternately, the attacker might be able to bypass intended access restrictions for the associated data fork.

Skutki

• Access Control, Non-Repudiation, Other

  Bypass Protection Mechanism; Hide Activities; Other

Zapobieganie

• Implementation

  Ensure that the source code correctly parses the filename to read or write to the correct stream.

Przykłady podatności

• CVE-1999-0278 In IIS, remote attackers can obtain source code for ASP files by appending "::$DATA" to the URL.
• CVE-2000-0927 Product does not properly record file sizes if they are stored in alternative data streams, which allows users to bypass quota restrictions.

Słabość nadrzędna

• CWE-66 Improper Handling of File Names that Identify Virtual Resources

Kiedy powstaje

• Implementation

Dotyczy

Not Language-Specific, Windows

Uwagi

This and similar problems exist because the same resource can have multiple identifiers that dictate which behavior can be performed on the resource.

Źródła

1. Windows NTFS Alternate Data Streams — Don Parker, 2005
2. Writing Secure Code — Michael Howard, David LeBlanc, Microsoft Press, 2002