ReadDirectoryChangesW() in Microsoft Windows 2000/XP/2003/Vista does not check a user’s permissions for child objects, making it possible to retrieve information about objects that a user has no LIST permissions for.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/54652/readirchange.txt
Source: https://packetstormsecurity.com/files/54652/readirchange.txt.html