Unbelievable security loophole (Vista/7)

Just happened-on this page:



and was somewhat alarmed to see the footnote:

"Note:If you don’t want your user profile folder visible from the network,
don’t share any files from within your profile. Sharing a file from within
your profile automatically causes the %SystemDrive%\Users folder to be shared
on the computer..."

This sounds so ridiculous I wondered if the writer had actually got his
facts straight. A quick test with Windows 7 indicated that yes, he had.

Having shared a specific folder in the user's profile I could then access
the entirety of the profile-root across the network, file permissions
allowing. This meant that, among other things, I had read access to the
entirety of the Default profile.

A test on an XP machine shows that the issue is, thankfully, limited to
Vista/7.

Inevitable question: Any way to fix this behavior so that sharing controls
do ONLY what they are supposed to do?

 

On Mon, 14 Sep 2009 15:02:02 -0700, Anteaus wrote:
<!--coloro:blue--><span style="color:blue <!--/coloro-->
> Inevitable question: Any way to fix this behavior so that sharing controls
> do ONLY what they are supposed to do?<!--colorc--><!--/colorc-->

Use Advanced Sharing rather than the Sharing Wizard.

--
Paul Adare
MVP - Identity Lifecycle Manager

 

That does nothing to prevent this happening in future.

In order prevent future security breaches we'd need to DISABLE this faulty
Sharing Wizard, and I don't know of any way to do that.

"Paul Adare" wrote:
<!--coloro:blue--><span style="color:blue <!--/coloro-->
> Use Advanced Sharing rather than the Sharing Wizard.<!--colorc--><!--/colorc-->