Shared Workstation Setup May Permit Access to Recycle Bin Files

ID: Q248399

The information in this article applies to:

Microsoft Windows NT Workstation version 4.0

SYMPTOMS

On a shared computer, it may be possible for a user to create a folder in the %SystemRoot\Recycler folder that is then assigned to another user based on the Security Identifier (SID) number. If you do this, a malicious user may assign themselves extended rights to the newly created Recycle Bin folder before it is assigned to another user.

This allows someone the ability to insert files into a user's Recycle Bin or permanently delete a user's files located in that specific Recycle Bin.

This vulnerability does not allow the malicious user to read the files in the Recycle Bin folder.

NOTE: This patch does not apply to computer's that use FAT partitions because disk security features cannot be enabled on these computers.

RESOLUTION

A supported fix that corrects this problem is now available from Microsoft, but it has not been fully regression tested and should be applied only to systems experiencing this specific problem. If you are not severely affected by this specific problem, Microsoft recommends that you wait for the next that contains this fix.

The following files are available for download from the Microsoft Download Center. Click the file names below to download the files:

Q248399i.exe for Intel-based computers

Q248399a.exe for Alpha-based computers

The English-language version of this fix should have the following file attributes or later:


   Date       Time     Size        File name     Platform
   -------------------------------------------------------------
   01/18/00   02:47p   1,280,784   Shell32.dll   x86
   01/18/00   02:47p   1,857,808   Shell32.dll   Alpha

For more information about how to download files from the Microsoft Download Center, please visit the Download Center at the following Web address

http://www.microsoft.com/downloads/search.asp

and then click How to use the Microsoft Download Center.

STATUS

Microsoft has confirmed this to be a problem in Windows NT 4.0.

MORE INFORMATION

The Windows NT Recycle Bin for a user maps to a folder in %SystemRoot%\Recycler. The name of the folder is based on the owner’s SID. The folder is created the first time the user deletes a file, and the owner is given the only permissions to it. However, if a malicious user can create the folder before the real one is created, that user could assign permissions that give them the ability to delete files from it or add files to it.

There are several significant limitations that make it extremely difficult to exploit this vulnerability. The malicious user would need to share a machine with the other user, and would need to create the bogus Recycle Bin before the user’s bona fide folder were created. This vulnerability only enables the malicious user to take action against the Recycle Bin on the particular machine that is attacked. The vulnerability does not allow the malicious user to read any files in the other user’s Recycle Bin, nor would it give him or her a means of inducing the other user to retrieve a bogus file from it.

For related information on this problem, please visit the following Microsoft Web site:

http://www.microsoft.com/security/bulletins/ms00-007faq.asp

For additional security-related information about Microsoft products, please visit the following Microsoft Web site:

http://www.microsoft.com/security/

Additional query words:

Keywords : kbenv ntsecurity kbbug4.00 kbfix4.00
Version : winnt:4.0
Platform : winnt
Issue type : kbbug