[Full-disclosure] FYI: MS06-049 patch (920958) corrupts NTFS compression files



just FYI...

MS06-049 patch (920958) corrupts NTFS compression files.

Affected sytem
--------------

Windows 2000 SP4 + MS06-049 patch (920958)

Discussion
----------

* Discussion in english:
http://www.microsoft.com/technet/community/newsgroups/dgbrowser/en-us/default.mspx?&query=920958&lang=en&cr=US&guid=&sloc=en-us&dg=microsoft.public.win2000.file_system&p=1&tid=d826afe9-2ab1-4b2f-ae11-cc27702f574a
* Discussion in japanese:
http://slashdot.jp/~oops/journal/
http://pc8.2ch.net/test/read.cgi/win/1151414872/47-
http://slashdot.jp/security/article.pl?sid=06/09/10/068243

How to demonstrate
------------------

1. Creat folder on NTFS partition.
2. Enable NTFS compression to that folder.
3. Insert Windows 2000 Installation disk to your CD-ROM drive.
4. Copy all files from Windows 2000 Installation disk to that
folder.
5. Compare.

How to prevent
--------------

Uninstall MS06-049 patch (920958).

How to find corrupted files
---------------------------

Try findcorr tool (by 147-win/1151414872):
http://211.2.20.24/pub/findcorr.lzh

C:\> findcorr.exe
Usage: findcorr [-a] [-d] [-e] path

Options:
-a Scan all files including uncompressed files.
-d Report compression directories.
-e Exact mode.

How to fix corrupted files
--------------------------

Restore them from backups.

Patch and NTFS compression
--------------------------

If you install patch, patch installer create backup folder for
uninstall, such as C:\WINNT\$NtUninstallKB920958$, and copy old
files to it.

This folder is NTFS compression enabled automatically. You
cannot turn off this feature.

Official information from Microsoft
-----------------------------------

Not yet, but they are working to fix problem.

- kjm

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages

  • Re: Broken Sword 5 kickstarter and free fan game
    ... to delete everything I downloaded on bs25 game and patch and download them ... DOWNLOAD sign I clicked on that and it says "your download is ready,. ... I then unzip the game archive to ... Then I go to the other folder (the patch ...
    (comp.sys.ibm.pc.games.adventure)
  • Re: Finally upgrading to Clipper 5.3 from S87
    ... patch and trying to install it. ... > timestamps in the folders, as all files in each folder were not patched ... > indicates the limit of memory Exospace can allocate, ...
    (comp.lang.clipper)
  • Re: KB920872 changes microphone settings
    ... If no, then show hidden files, folders, and system files: ... If it is present and NOT showing in ARP, then open the folder, and open the spuninst subfolder. ... Another interesting note, if the patch is uninstalled, then the microphone settings are set back to what they are supposed to be, the patch can then be reinstalled and it does not change the microphone settings again. ...
    (microsoft.public.windowsupdate)
  • Re: DST Patch for Pakistan according to new change in Aug-2008
    ... Zone patch at most once per year, and the last two times it was deep winter ... Zones\Pakistan Standard Time" ... Thus, you would create a folder that includes the updated REG file, ... sync the time with time servers using Windows's list of servers, ...
    (microsoft.public.windowsxp.general)
  • Re: NTFS Compression - question
    ... I compressed this folder using NTFS compression. ... They are still individual files, ... must occupy at least one allocation unit. ...
    (microsoft.public.windowsxp.general)