access to user data

[Unknown_User_423]

In a web page, Ian "Gizmo" Richards said, "the third technique was the most advanced. It involved rebuilding the system descriptor table using a special utility and then terminating with APT. I have since communicated this with the author of Sandboxie and he has confirmed the problem. The hole will be closed in a an upcoming version. NOTE: This vulnerability has now been patched. All versions from 2.62 onwards incorporate this patch. I have amended the results tables accordingly. Gizmo 2nd Oct, 2006."

However, Ian Richards also talks about one vulnerability that hasn't been patched yet. He said, "SandBoxie too performed well and only failed in one test; user data is accessible to sandboxed processes."

I sincerely hope that you would be successful in providing a patch for this problem as well. Personal data on the "real PC" should not be accessible to sandboxed programs.

[SnDPhoenix]

uhh, isnt this normal, i mean the point of Sandboxie is not to limit access to certain folders, i mean it allows access to everything and anything, even your windows dir which is dangerous (if you arent running SBie), so obviously it will allow access to your "Personal Folders", the point of SBie is to intercept all write operations and commit them in a sandbox instead of onto your "RealPC's" HD, that way nothing in the sandbox gets written to the HD, thus keeping you protected from s#@% trying to infect your HD, now i think you can block access to certain files and folders, but ive never checked cause i dont have personal data on my hd that im worried about .

[tzuk]

However, Ian Richards also talks about one vulnerability that hasn't been patched yet. He said, "SandBoxie too performed well and only failed in one test; user data is accessible to sandboxed processes."

If this is a vulnerability or not, it depends on your definition. But in any case, Sandboxie has always had an option to block access to files and folders:

ClosedFilePath

[Rasheed187]

Perhaps an idea to make this more easily configurable via the GUI?

[tzuk]

Thank you Rasheed. I don't think I would have thought of it myself.

[Rasheed187]

I certainly do hope that this stuff will be more easy to use, I´m not a real fan of having to edit stuff in configuration files myself.