Re: Microsoft Windows Vista/2003/XP/2000 file management security issues

To: "Steven M. Christey" <coley@xxxxxxxxx>
Subject: Re: Microsoft Windows Vista/2003/XP/2000 file management security issues
From: Richard Huxton <dev@xxxxxxxxxxxx>
Date: Tue, 13 Mar 2007 16:21:51 +0000
Cc: bugtraq@xxxxxxxxxxxxxxxxx
In-reply-to: <200703122314.l2CNEaLU014080@xxxxxxxxxxxxxxx>
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
References: <200703122314.l2CNEaLU014080@xxxxxxxxxxxxxxx>
User-agent: IceDove 1.5.0.9 (X11/20061220)

Steven M. Christey wrote:

3APA3A said:

I. There is no symlinks under Windows. Symlink attacks are not
possible.


There's something similar on NTFS:
http://www.microsoft.com/technet/sysinternals/FileAndDisk/Junction.mspx
http://en.wikipedia.org/wiki/NTFS_symbolic_link

Only reason I know is because I remember the Win32 porters of PostgreSQLlooking around for symlinks on Windows.


--
  Richard Huxton
  Archonet Ltd

References:
- Re: Microsoft Windows Vista/2003/XP/2000 file management security issues
  - From: Steven M. Christey

Prev by Date: Re: Iframe-Cash/Iframe-Dollars Adware bundle...oooh... my ....god..
Next by Date: Re: Iframe-Cash/Iframe-Dollars Adware bundle...oooh... my ....god..
Previous by thread: Re[2]: Microsoft Windows Vista/2003/XP/2000 file management security issues
Next by thread: PHP import_request_variables() arbitrary variable overwrite
Index(es):
- Date
- Thread