Description
Windows Firewall in Microsoft Windows XP SP2 does not produce application alerts when an application is executed using the NTFS Alternate Data Streams (ADS) filename:stream syntax, which might allow local users to launch a Trojan horse attack in which the victim does not obtain the alert that Windows Firewall would have produced for a non-ADS file.
References
- 20060324 Microsoft Windows XP SP2 Firewall issue mailing-list
- winxp-firewall-ads-bypass(25597) vdb-entry
- 20060327 Re: Microsoft Windows XP SP2 Firewall issue mailing-list