Internal Info: Admin Computing Personnel Safety Stores Teaching Web email Links: Funding Bodies Learned Societies University of Oxford World Wide

Computing  Windows File Sharing

A serious security problem has been discovered with the file sharing software provided in Windows 95/98/Millennium Edition (Windows NT is not affected). Until the correct security patches are applied, it is possible for anyone on the Internet to gain access to any files and folders shared to the "Network Neighbourhood" without needing the correct password for the share.

If you have Windows file sharing turned on then we strongly recommend that you disable it for the moment.

Computing staff do not normally install the file sharing component when adding a computer to the network. However, many users have subsequently installed it, or requested it, to allow "peer-to-peer" sharing of files or printers over the network.

To see if you have file sharing installed on your computer:

• Right-click on the Network Neighbourhood icon and choose Properties from the pop-up menu.

• Check the list of network components, looking for one called File and printer sharing for Microsoft Networks.

• If this is not present then you need not worry.

• If it is present then we suggest that you select it, and then press the Remove button. Your computer will no longer be visible in the "Network Neighbourhood", but it will be secured against outside tampering.

For the benefit of those who need file and printer sharing, we will endeavour to make the appropriate patches available from Microsoft as soon as possible. Patches for Windows 95, Windows 98, Windows 98 Second Edition and Windows Millennium Edition are available in the network folder N:\windowsupdate\FileSharingSecurity (nobody in the Department is running Millennium Edition, so far as I am aware, but I provide the patch for completeness).

We would, however, urge people to give serious consideration to avoiding peer-to-peer file sharing between Windows machines wherever possible, by using their home directories or group shared file areas on the Departmental file server, for example.