MS06-049 $BI{:nMQ(B (NTFS $B05=L%U%!%$%k$,!V2u$l$k!W(B) $B$^$H$a(B

MS06-049 $B%Q%C%A(B (920958) $B$r%$%s%9%H!<%k$9$k$h!"(bntfs $B05=L$7$?%U%!%$%k$,!V2u$l$k!W$3$H$,$"$kOC$N$^$H$a!#(B ($B0E9f2=$N>l9g$b3:Ev$9$k$H$$$&Js9p(B$B$b$"$j$^$9(B)

Windows 2000 SP4 + MS06-049 $B%Q%C%A(B (920958)

$BF|K\8l(B:

• oops$B$NF|5-(B (slashdot.jp)$B!#:G=i$NJs9p$B"#(B$B$7$+$/(B$B""(B$B$7$m$$$7$+$/(BNTFS$B$G$9$J(B?$B$$$^$@$K(BFAT$B$G$9$+(B?$B""(B$B$7$m$$$7$+$/(B$B"#(B$B$7$+$/(B (2ch.net)$B!#(B #47 $B0J9_(B $B$r;2>H!#(B
• 9$B7n$N7nNc%Q%C%A$O(B3$B7o!"6[5^$r4^$`(B (slashdot.jp)
• Windows2000$B$N%Q%C%AE,MQ$K$h$k(BNTFS$BGKB;$NIT6q9g$,=$@5$5$l$k(B (slashdot.jp)
• MS06-049[$B=EMW(B]:Windows $B%+!<%m%k$n@h:3J$5$l$k(B (hotfix report BBS)

$B1Q8l(B:

• Since weekend update, small files up to 4096 bytes get corrupted in Windows 2000 File System and Services (Microsoft TechNet)
• [Full-disclosure] FYI: MS06-049 patch (920958) corrupts NTFS compression files

1. NTFS $B%Q!<%f%#%7%g%s$k%u%)%k%@$r:n@.$9$k(b
2. $B$=$N%U%)%k%@$G(B NTFS $B05=L$rM-8z$K$9$k(B
3. Windows 2000 $B%$%s%9%H!<%k(b CD $B$r(B CD-ROM $B%I%i%$%V$K%;%C%H$9$k(B
4. Windows 2000 $B%$%s%9%H!<%k(b CD $BFb$NA4%U%!%$%k$r!":n@.$7$?%U%)%k%@$K%3%T!<$9$k(b
5. $BN>

   $BHf3SNc(B: $B:8$,(B NTFS $B05=L$J$b$N!"1&$,(B CD $B$N$b$N!#I=<($k;h$c$f$$$k$n$o(b HashTab Shell Extension$B!#(B

MS06-049 $B%Q%C%A(B (920958) $B$r%"%s%$%s%9%H!<%k$9$k!#(b

MS06-049 $B%Q%C%A(B (920958) $B$N?7HG$rE,MQ$9$k!#(B $B$"$k$$$O!"(B$B=$@5%W%m%0%i%`(B$B$r%@%&%s%m!<%i$7$fe,mq$9$k!#(b $B$?$@$7!"!V2u$l$?!W%U%!%$%k$r5_=P$7$F$+$i$K$7$?J}$,$h$$$@$m$&(B ($B8e=R(B)$B!#(B

147-win/1151414872 $B;a:n@.$N(B findcorr $B$rMxMQ$9$k$H$h$$!#;H$$J}(B:

C:\> findcorr.exe
Usage: findcorr [-a] [-d] [-e] path
Options:
 -a Scan all files including uncompressed files.
 -d Report compression directories.
 -e Exact mode.

findcorr.lzh $B$O$3$^$a$K99?7$5$l$F$$$k$N$G!":G?7HG$rMxMQ$5$l$?$$!#(B

($B:o=|(B) $B=$I|$G$-$J$$!#%P%C%/%"%C%W$+$iLa$9$7$+$J$$!#(B ($B:o=|$3$3$^$G(B) $BJ#?t$NJ}K!$,$"$k!#(B

• FreeBSD 6.1-RELEASE $B$G(B mount $B$7!"FI$_=P$9!#(B NetBSD 3.0.1 $B$G$bFI$_=P$;$?$H$N(B$BJs9p(B$B$,$"$k!#(B
• ntfstools $B$K(B 599 (2ch.net) $B$H(B 611 (2ch.net) $B$N(B patch $B$r$"$F$F:n@.$7$?(B ntfscat $B$r;H$C$FFI$_=P$9!#(B

$BFI$_=P$7$?8e$G(B MS06-049 $B%Q%C%A(B (920958) $B$N?7HG$rE,MQ$7$F:F5/F0$7!"(B $BFI$_=P$7$?%U%!%$%k$G>e=q$-$9$k$H$h$$$@$m$&!#(B

$B"#(B$B$7$+$/(B$B""(B$B$7$m$$$7$+$/(BNTFS$B$G$9$J(B?$B$$$^$@$K(BFAT$B$G$9$+(B?$B""(B$B$7$m$$$7$+$/(B$B"#(B$B$7$+$/(B (2ch.net) $B$N(B 443 $B0J9_(B $B$r;2>H!#(B

NTFS $B05=L$,%G%U%)%k%H$GM-8z$K$J$C$F$$$k%U%)%k%@$O0J2<$n$h$*$j!#(b

• $B%Q%C%A$r%$%s%9%H!<%k$9$k$h:n@.$5$l$k!"%p%c%/%"%c%w%u%)%k%@!#(b

  $B%Q%C%A$r%$%s%9%H!<%k$9$k$h!"(bc:\winnt\$ntuninstallkb920958$ $B$N$h$&$JL>A0$N%U%)%k%@$,:n@.$5$l!"5l%U%!%$%k$O$=$3$K%P%C%/%"%C%W$5$l$k!#(B $B$3$N%U%)%k%@$O<+f0e*$k(b NTFS $B05=L$5$l$k!#(B $B$3$l$O;EMM$G$"$j!"$7$+$bL58z$K$G$-$J$$!#(B

• DLL $B%-%c%C%7%e%U%)%k%@(B (%windir%\system32\dllcache)$B!#(B

NTFS $B05=L$J$s$F;H$C$F$$$J$$$+$i0B?4!"$H;W$C$F$O$$$1$J$$!#(B

$B0J2<$n>l9g$K$O$3$NLdBj$OH/@8$7$J$$!#(B

• FAT $B$r;H$C$F$$$k>l9g(B ($B$"$?$j$^$((B)$B!#(B

• NTFS $B$r!"(B4096 $B%P%$%H$h$jBg$-$$%/%i%9%?%5%$%:$G;HMQ$7$F$$$k>l9g(B (NTFS $B05=L$,$G$-$J$$(B)$B!#;2>H(B: KB140365: FAT $B$*$h$S(B NTFS $B$N%G%U%)%k%H$N%/%i%9%?(B $B%5%$%:(B

• KB920958 - MS06-049: Vulnerability in Windows kernel could allow elevation of privilege (Microsoft)
• KB920958 - [MS06-049] Windows $B%+!<%m%k$n@h:3J$5$l$k(B (Microsoft)
• KB925308 - Compressed files that are larger than 4 kilobytes may be corrupted when you create or update the files (Microsoft)
• KB925308 - 4 KB $B$h$jBg$-$$%5%$%:$N05=L%U%!%$%k$r:n@.$^$?$O99?7$9$k$H!"%U%!%$%k$,GKB;$9$k$3$H$,$"$k(B (Microsoft)
• Known Issue Documented for MS06-049 (MSRC blog, 2006$BG/(B9$B7n(B15$BF|(B)