Vulnerability Development mailing list archives
Re: long file names in explorer.exe
From: rsavage () CROSSWINDS NET (Rory Savage)
Date: Fri, 28 Apr 2000 17:58:08 -0400
kj, I suspect that explorer concatenates long file names rather than causing a buffer overflow. Why the prefixes of the files included a ~ and odd charactes? I don't know, it just might be random data. But notice that the prefixes are four characters long E~XX.XXX. This might happen as a last resort to keep the file names under the 8.3 file standard. What does microsoft have to say about this? Rory Savage -- Systems Administrator email: rsavage () crosswinds net .-.-.-..---..-..-..---. | | | || | || .` || |'_ `-----'`-^-'`-'`-'`-'-/ -=/ MCI WorldCom/WANG/FAA \=- work (919)-377-7702 beep (800)-PAGE-MCI page mail: 1433539 () pagemci com On Wed, 26 Apr 2000, kj wrote:
Hey, all I have done a few tests on NT 4.0 (SP5) and Windows 2000 (build 2128) creating long file name extensions and trying to copy and view them in explorer.exe. Both OS' did not crash when the tool tips displayed the long extensions, but I did notice other "odd" behavior. I had 4 files that I was playing with c.`perl -e 'print "a" x 232'` e.`perl -e 'print "a" x 240'` e.`perl -e 'print "f" x 250'` f.`perl -e 'print "f" x 247'`From samba to WINNTCopying the files to another computer through network neighbourhood: "c.aaa..." recieved "file extension is too long" "e.aaa..." recieved an error that "file cannot find the specified path..." "e.fff..." became "E~lh.fff" "f.fff..." became "F~ki.fff" Copying to the same directory as what the files were already in (on samba): "c.aaa..." crashed explorer.exe "e.aaa..." crashed explorer.exe "e.fff..." became "E~LH.FFF" "f.fff..." became "F~KI.FFF" I have only tested samba and WINNT. I have yet to try Win2000...though I plan to tomorrow. K.J. -- "Never argue with an idiot. He will take you down to his level, and beat you with experience."
Current thread:
- Re: Securax Security Advisory: Windows98 contains a seriousbuffer overflow with long filenameextensions., (continued)
- koules again Kotz (Apr 21)
- Re: koules again Ron DuFresne (Apr 21)
- Re: No-Exec Stack Smashing 101 Granquist, Lamont (Apr 25)
- Re: No-Exec Stack Smashing 101 M.C.Mar (Apr 26)
- limited functionality accounts (was: Re: History Files) Alex Andrews (Apr 25)
- Re: limited functionality accounts (was: Re: History Files) Rob Kouwenberg (Apr 28)
- Re: No-Exec Stack Smashing 101 Granquist, Lamont (Apr 26)
- long file names in explorer.exe kj (Apr 26)
- Re: long file names in explorer.exe Rory Savage (Apr 28)
- Re: long file names in explorer.exe kj (Apr 28)
- Lotus notes + windows98 overflow Alistair Orchard (Apr 27)
- Blind Remote Buffer Overflow Granquist, Lamont (Apr 27)
- Eudora Pro Buffer Overflow testing in progress - help needed. Zoa_Chien (Apr 28)
- Re: Eudora Pro Buffer Overflow testing in progress - help needed. Blue Boar (Apr 28)
- Re: Blind Remote Buffer Overflow Marc (Apr 28)
- Re: Blind Remote Buffer Overflow Ralph The Wonder Llama (Apr 28)
- Re: Blind Remote Buffer Overflow Matthew R. Potter (Apr 28)
- Re: Blind Remote Buffer Overflow Sebastian (Apr 29)
- Re: Blind Remote Buffer Overflow Mark L. Jackson (Apr 29)
