in

eEye Digital Security

The endpoint to vulnerability starts here.

 

Vulnerability Scanner - NTFS 8 Filenames - Value 0 or 1

Last post 10-16-2009 11:14 AM by Blue1978. 1 replies.
Page 1 of 1 (2 items)
Sort Posts: Previous Next
  • 10-09-2009 5:03 PM

    Vulnerability Scanner - NTFS 8 Filenames - Value 0 or 1

    Vulnerability scanner requires conflicting values for NtfsDisable8dot3NameCreation, as shown below. It's my understanding, if the value is set to 1, then short filenames are _not_ created. This value,however, only affects new writes (not on existing files/directories). If the value is missing or set to 0, then short filenames _are_ created. The audit requires both values;  both vulnerabilities show. Please advise?

    Note: In my initial install version, Personal Version 4.3.2, Vulnerability Scanner v.5.10.12, Audits v.2115, only the "FDCC" was included in the vulnerability list, as I have it set to 1.

    OS: XP,SP3
    Blink Personal Version 4.4.2, Rule version 1543
    AntiVirus Version 1.0.797
    Vulnerability Scanner version 5.10.15, Audits version 2144

    Registry NTFS 8 Dot 3
    CVE CVE-1999-0012
    Description NTFS has the ability to support backwards compatibility with older 16 bit apps. It is recommended not to use 16-bit apps on a secure server since it could allow attackers to bypass access restrictions for files with long file names.
    How To Fix To disable 8.3 file names set the following registry key settings:

    Hive: HKEY_LOCAL_MACHINE
    Path: System\CurrentControlSet\Control\FileSystem
    Key: NtfsDisable8dot3NameCreation
    Type: REG_DWORD
    Value: 1
    =====
    Windows Microsoft Windows NTFS 8.3 Filenames - FDCC 
     Description The setting for "MSS: (NtfsDisable8dot3NameCreation) Enable the computer to stop generating 8.3 style filenames" does not meet FDCC requirements.
    How To Fix To set NtfsDisable8dot3NameCreation to disabled, set the following registry key settings:

    Hive: HKEY_LOCAL_MACHINE
    Path: System\CurrentControlSet\Control\FileSystem
    Key: NtfsDisable8dot3NameCreation
    Type: REG_DWORD
    Value: 0

  • 10-16-2009 11:14 AM In reply to

    Re: Vulnerability Scanner - NTFS 8 Filenames - Value 0 or 1

    Brian,

         Is this one of those audits that conflicts because the FDCC requirement is different than the other hence you always will show one of them regardless of what you choose?

Page 1 of 1 (2 items)
© 1995 - 2009 eEye Incorporated