SMB I/O using printer share
advICE :Intrusions : 2000503

Summary

Older versions of Windows 95 expose their entire hard disks through the PRINTER$ share. An attempt to read files from this share has been made.

Details

Windows 95 and Windows 98 use the PRINTER$ share in order to allow one computer to print to the another's printer.

However, multiple vulnerabilities exist that might allow an intruder extended access to the machine. The intruder can read any file in a certain windows directory. Furthermore, older version of Windows 95 allow the intruder to read any file on a machine through this share.

Defense

File and Print Sharing is extremely dangerous, and should be unbound from the TCP/IP stack. This can be done by choosing "Properties" on the "Network Neighborhood" icon, selecting "File and Print Sharing", selecting "Bindings", and turning off the connection to TCP/IP. Other protocols, such as NetBEUI or IPX, should be used for sharing printers within the household.

The hack that allows access to the entire hard disk only applies to older versions of Windows 95 systems, prior to the OSR-2 release.

parametric information filename The name of the file accessed using the printer share.

 
Version appeared: