[8191] in bugtraq
NT Stream creation through ftp
daemon@ATHENA.MIT.EDU (Bertrand VELLE)
Tue Oct 13 15:03:08 1998
Date: Tue, 13 Oct 1998 10:08:06 +0200
Reply-To: Bertrand VELLE <Bertrand.Velle@APOGEE-COM.FR>
From: Bertrand VELLE <Bertrand.Velle@APOGEE-COM.FR>
To: BUGTRAQ@NETSPACE.ORG
Hello,
While trying to download the 'old' CERT advisories from my NT workstation,
I've discovered that the command line ftp NT client deals with the ':'
characters embedded in the file names. To test this, try to download some
files from the ftp.cert.org pub/cert_advisories and have a look to your
directory.
You'll find something like:
Name Size
CA-89 0
CA-90 0
CA-91 0
Then using the streamfind utility (www.march.co.uk) you could verify that
all downloaded files have been stored as alternate streams.
CA-89 Alternate stream: 01.passwd.hole
Alternate stream: 02.sun.restore.hole
and so on ....
This is due to the fact that the used file naming convention
(CA-XX:YY.zzzzz) contains the infamous ':' character which is interpreted
here as a stream delimiter ....
--
Bertrand VELLE Security Consultant
velle@apogee-com.fr APOGEE Communications ORSAY, FRANCE
