IIS Server Security - Can create a file in a read-only directory

Author

Can create a file in a read-only directory

Birger Niss

2006-01-17, 8:03 am

Hi,

I have an ASP.NET 2 application configured to use impersonation. The
application is running in IIS on an XP test machine.
With this application I am able to create a temporary file using:

new FileStream(TemporaryFileName, FileMode.Create))

in a directory to which the logged-in (and impersonated) user has only read
access. Immediately afterwards the application attempts to delete the file,
but it fails with access denied.
Inspecting the created file in explorer shows that the owner is indeed the
impersonated user.

Running the same application on Windows 2000 and 2003 servers does not show
this misbehavior.

Any suggestions will be appreciated!

Best regards
Birger Niss