Re: [Full-disclosure] Microsoft Windows Vista/2003/XP/2000 file management security issues

[czino2@xxxxxxx]

The Knaller 2007 
You surf in the Internet and pay billions others, to reach you as customers.
 It wouldn't be beautiful, if you could also get what ?? 
This is no more dream now. Agloco makes this possible. No costs or subsequent 
costs 
 
?? and the income ?? 
 
Become partners and another 5 partners advertise.
 Everybody surfs for 5 hours in the month 
makes 761.25 dollars = with 10 partners 1517.50 dollars = 
(The computer is in the member area) 
 
Registering now free of charge.
 
In addition, you get money in the Internet by the surfing at activated view 
beard. 100% of the profit are distributed to the members by AGLOCOT because. 
The one who further builds up the community can in addition earn more: because 
you recommend AGLOCOT per more persons, you can make a the higher profit. This 
comes that not only your online hours but also that one of your recommendations 
be collected on your account. And just as also the hours of the recommendations 
of your recommendations up to the 5th level! This will be a strong drive for 
this to extend the member number very fast for certain. In the month, you can 
get more as 7,000 shares if e.g. you have attracted 10 persons, and each of 
these in turn 5 persons!
 
Lose no time. This is a Win-Win opportunity and all the more profitable it gets 
for you if you still have your friends and family registered today before 
others make it!
 
 
 
 
 
-----Ursprüngliche Mitteilung----- 
Von: hackbunny@xxxxxxxxxx
An: full-disclosure@xxxxxxxxxxxxxxxxx
Verschickt: So., 11. Mrz. 2007, 0:50
Thema: Re: [Full-disclosure] Microsoft Windows Vista/2003/XP/2000 file 
management security issues


3APA3A wrote:

>  And now is most exciting: Users have permission to create files in this
>  directory, that is pre-open attack is possible.

holy %&$@£%!# you're right:

D:\WINDOWS\security\templates>more "setup security.inf" | findstr /r /i 
"\<temp\>"
"d:\windows\temp", 2, 
"D:P(A;CI;0x100026;;;BU)(A;CIOI;GRGWGXSD;;;PU)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)
(A;CIOI;GA;;;CO)"

Where "(A;CI;0x100026;;;BU)" =
    A = access allowed
    CI = container and items (subfolders and files), this folder only
    0x100026 = SYNCHRONIZE, traverse, create files, create subfolders
    BU = BUILTIN\Users

/revokes
/plans to eventually make a custom security policy .inf

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
________________________________________________________________________
Kostenlos: AOL eMail
2 GB Speicherplatz sowie erstklassiger Spam- und eMail Virenschutz.
Sichern Sie sich Ihre persönliche eMail Adresse noch heute!

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/