UNCLASS
PASS TO SITE/FACILITY/COMMAND INFORMATION SYSTEM SECURITY OFFICER
{ISSO}, SPECIAL SECURITY OFFICER {SSO}, INFORMATION RESOURCE MANAGER
{IRM} AND AUTOMATED DATA PROCESSOR {ADP} COORDINATORS
SUBJECT:  BUG IN DOS CHKDSK {AUTOMATED SYSTEM SECURITY INCIDENT
SUPPORT TEAM {ASSIST} BULLETIN 92-68}.
1.  THIS BULLETIN ADDRESSES A PROBLEM THAT EXISTS IN THE DOS CHKDSK
UTILITY.  THIS PROBLEM IS NOT DIRECTLY RELATED TO SYSTEM SECURITY, BUT
IT DOES CREATE THE POSSIBILITY FOR SIGNIFICANT AMOUNTS OF ACCIDENTAL
DATA LOSS ON DOS COMPUTER SYSTEMS.
2.  THE PROBLEM EXISTS WITH CHKDSK IN MS-DOS AND PC-DOS VERSIONS 4
AND 5.0 SHIPPED BEFORE 11 NOVEMBER, 1991.  IF A PC UTILIZING ONE OF
THE DOS OPERATING SYSTEMS SPECIFIED IN THIS MESSAGE HAS A 256 SECTOR
FILE ALLOCATION TABLE (FAT), AND ONE OF THE FOLLOWING PARTITION
SIZES: 128, 256, 512, 1024 MB, CHKDSK USED WITH THE /FIX OPTION WILL
OVERWRITE A PORTION OF THE HARD DISK.  IBM AND MICROSOFT KNOW ABOUT
THE PROBLEM - IT IS DOCUMENTED AS Q80496 ON THE MICROSOFT KNOWLEDGE
BASE. IT IS IMPORTANT THAT USERS BE INFORMED ABOUT THIS PROBLEM
BECAUSE THEY MAY ASSUME DATA LOSS WAS CAUSED BY THE SUSPECT DISK THEY
WERE TRYING TO RESTORE, WHEN THE FAULTY CHKDSK UTILITY WAS REALLY THE
CAUSE.
3.  DESCRIPTION: USERS RUNNING CHKDSK WITH THE /F OPTION HAVE 256
COPIES OF THE FAT WRITTEN ONTO THEIR HARD DISK STARTING AT THE FIRST
COPY OF THE FAT.  THIS RESULTS IN ALL DIRECTORY INFORMATION AND A
SIGNIFICANT AMOUNT OF THE DATA IN THE DATA AREA BEING IRRECOVERABLY
DESTROYED.
HOW TO TELL IF YOU'RE AT RISK: RUN CHKDSK WITHOUT THE '/F' OPTION AND
CHECK THE "TOTAL ALLOCATION UNITS ON DISK".  IF THIS NUMBER IS MORE
THAN 65280, YOU ARE AT RISK.  DO NOT USE CHKDSK TO CORRECT ANY DISK
PROBLEMS IF THIS IS THE CASE.
SOLUTION: CALL MICROSOFT AND REQUEST THE DOS 5.00A UPGRADE WHICH HAS
THE CORRECTED VERSION OF CHKDSK.
4.  POINT OF CONTACT:  ASSIST POINT OF CONTACT FOR THIS MATTER IS
MIKE HIGGINS, COMM {703} 696-1904/24 OR DSN 226-1904/24.  ASSIST CAN
BE REACHED 24 HOURS PER DAY, COMMERCIAL PAGER {800} SKY-PAGE {800-
759-7243}, PIN NUMBER 2133937.  WHEN CALLING THE PAGER SERVICE,
FOLLOW THE AUTOMATED VOICE INSTRUCTIONS AND ENTER THE CALL BACK
NUMBER AFTER THE PROMPT.  THE ASSIST DUTY OFFICER WILL CALL YOU BACK
WITHIN 30 MINUTES.  IF FASTER SERVICE IS REQUIRED, PREFIX YOUR
TELEPHONE NUMBER WITH "999", AND THE ASSIST DUTY OFFICER WILL CALL
BACK WITHIN 5 MINUTES.  ASSIST CAN BE REACHED VIA E-MAIL AT "DOD-
CERT{AT-SIGN}DDN-CONUS.DDN.MIL".
BT