Improper Handling of Windows ::DATA Alternate Data Stream
Incomplete Variant
Structure: Simple
Description
The product does not properly prevent access to, or detect usage of, alternate data streams (ADS).
An attacker can use an ADS to hide information about a file (e.g. size, the name of the process) from a system or file browser tools such as Windows Explorer and 'dir' at the command line utility. Alternately, the attacker might be able to bypass intended access restrictions for the associated data fork.
Common Consequences 1
Scope: Access ControlNon-RepudiationOther
Impact: Bypass Protection MechanismHide ActivitiesOther
Potential Mitigations 2
Phase: Testing
Software tools are capable of finding ADSs on your system.
Phase: Implementation
Ensure that the source code correctly parses the filename to read or write to the correct stream.
Observed Examples 2
CVE-1999-0278In IIS, remote attackers can obtain source code for ASP files by appending "::$DATA" to the URL.
CVE-2000-0927Product does not properly record file sizes if they are stored in alternative data streams, which allows users to bypass quota restrictions.
References 2
Windows NTFS Alternate Data Streams
Don Parker
16-02-2005
https://seclists.org/basics/2005/Feb/312(2023-04-07)
ID: REF-562
Writing Secure Code
Michael Howard and David LeBlanc
Microsoft Press
04-12-2002
ID: REF-7
Applicable Platforms
Languages:
Not Language-Specific : Undetermined
Modes of Introduction
Implementation
Related Attack Patterns
Functional Areas
- File Processing
Affected Resources
- System Process
- File or Directory
Related Weaknesses
Taxonomy Mapping
- PLOVER
Notes
TheoreticalThis and similar problems exist because the same resource can have multiple identifiers that dictate which behavior can be performed on the resource.