NetSight
IP …
medium4.6Public exploit code

CVE-2007-0843

The ReadDirectoryChangesW API function on Microsoft Windows 2000, XP, Server 2003, and Vista does not check permissions for child objects, which allows local u…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The ReadDirectoryChangesW API function on Microsoft Windows 2000, XP, Server 2003, and Vista does not check permissions for child objects, which allows local users to bypass permissions by opening a directory with LIST (READ) access and using ReadDirectoryChangesW to monitor changes of files that do not have LIST permissions, which can be leveraged to determine filenames, access times, and other sensitive information.

Affected products

VendorProductAffected versions
MicrosoftWindows 2000
All versions
MicrosoftWindows 2003 Server
All versions
MicrosoftWindows Vista
All versions
MicrosoftWindows Xp
All versions

Weakness classification

CWE-264

References