CVE-2005-0545

Vulnerability

On Windows XP Pro SP2 and Windows 2000 Server SP4 running Active Directory, group policies that hide specified drives in My Computer and prevent access to drives from My Computer can be bypassed. The policy is intended to restrict access but is not a security feature; it is a convenience setting [1]. Affected versions are Windows XP Pro SP2 and Windows 2000 Server SP4.

Exploitation

An attacker with local user access can use Microsoft Office 10 applications (e.g., Word, Excel) to browse and read the contents of restricted drives. Alternatively, using a flash drive can also bypass the policy. No special privileges beyond local user access are required.

Impact

Successful exploitation allows a local user to read files on drives that the group policy intended to hide or restrict. This leads to unauthorized information disclosure. The attacker does not gain elevated privileges but circumvents administrative restrictions.

Mitigation

The issue is disputed; the referenced post argues that the policy is a convenience setting, not a security boundary [1]. Microsoft has not released a fix, as the behavior is by design. Administrators should use appropriate ACLs or third-party software to truly prevent access to data [1]. No CVE listing in KEV.