Secunia

3APA3A has discovered a weakness in Microsoft Windows, which can be exploited by malicious, local users to gain knowledge of certain information.

The problem is caused due to the "ReadDirectoryChangesW()" API not taking into consideration the permissions of sub-directories when monitoring directories. This can be exploited to e.g. disclose file names in protected sub-directories.

Successful exploitation requires that the protected files are in a sub-directory where the parent directory is accessible by the attacker.

The weakness is confirmed on fully-patched Windows XP SP2 and Windows Server 2003 systems. Microsoft Windows 2000 and Vista are also reported to be affected.

Solution
Grant only trusted users access to the system.

Provided and/or discovered by
3APA3A

Changelog
Further details available in Customer Area

Original Advisory
http://lists.grok.org.uk/pipermail/full-disclosure/2007-February/052613.html

Deep Links
Links available in Customer Area