How does C;\con\con exploit work?

[udaki]

I know it has been fixed but I want to know how it works.I tried to acces the files but it said access denied.What is that file?

[solarismka]

This is what I found out:

http://seclists.org/lists/bugtraq/2000/Mar/0086.html

[udaki]

i already know how to use it but how does it actually work?is that like out of memory for windows or what?

[anphanax]

con, aux, nul, prn, lpt1-3, and com1-3 are device names that are treated as files. They cause problems for applications that try and open them as files.

For instance, in the command prompt (assuming you're not on windows 98 or earlier, which would instead give you the "Cannot run program in MS-DOS mode" error), you can type "write aux" and it MAY crash wordpad.

This is also why you can't have files with these names. (well, you could always edit the disk with a 3rd party tool). I think it's something to do with treating a device as a directory (something messes up internally, bad address returned, program tries to use, exception thrown)

Here's something from cmd.exe:
C:\Documents and Settings\Administrator>cd aux
The parameter is incorrect.

C:\Documents and Settings\Administrator>cd prn
The parameter is incorrect.

C:\Documents and Settings\Administrator>cd con
The system cannot find the path specified.

C:\Documents and Settings\Administrator>cd aux | cd aux
Access is denied.
The parameter is incorrect.

C:\Documents and Settings\Administrator\My Documents\filelib>copy con con

(Hit CTRL+BREAK)
The I/O operation has been aborted because of either a thread exit or an applica
tion request.
        0 file(s) copied.

C:\Documents and Settings\Administrator\My Documents\filelib>

[ June 04, 2004: Message edited by: anphanax ]