Current directory flaw

[Dan]

Create a batch file, with something like dir *.exe in it.
Put the batch file in a folder, anywhere on any drive.

Run the batch file. MS AntiSpyware asks whether to allow
or block, click Allow and the current directory has been
changed to %system root% (e.g. c:\windows\system32).. at
which point the batch file is executed on the system
folder.

We use batch files during our build process to clean exes
and dlls from our build folder. We were somewhat dismayed
to see that it cleaned exes and dlls from our system
folder.

Might we see a fix for this soon?

 

[Bill Sanderson]

You are absolutely right--this is a dangerous bug. It's known to the
developers and being fixed. Here's an article describing this issue and
others related to scripting:

http://www.microsoft.com/technet/scriptcenter/resources/articles/antispy.mspx