Microsoft is planning to release an out of band security update today to address the Windows shortcut vulnerability.
The vulnerability is caused by an error in Windows Shell when parsing shortcuts (.lnk). The flaw can be exploited automatically by executing a program via a specially crafted shortcut. Certain parameters of the .lnk are not properly validated on load, resulting in the vulnerability. Microsoft says it has "seen only limited, targeted attacks on this vulnerability."
For the exploit to be successful it requires that users insert removable media (when AutoPlay is enabled) or browse to the removable media (when AutoPlay is disabled). According to Microsoft's initial advisory, exploitation may also be possible via network shares and WebDAV shares. Microsoft stated that the exploit affects all Windows versions since Windows XP, including Windows 7.
Last week, the software giant issued a Fixit solution for customers, to help prevent attacks attempting to exploit this vulnerability. However, applying the fixit removed the graphical representation of icons on the Task bar and Start menu bar and replaced them with white icons without the graphical representation of the icon. This temporary fix wasn't ideal for most customers so Microsoft sped up testing to deliver an out of band fix.
"We are releasing the bulletin as we've completed the required testing and the update has achieved the appropriate quality bar for broad distribution to customers. Additionally, we're able to confirm that, in the past few days, we've seen an increase in attempts to exploit the vulnerability. We firmly believe that releasing the update out of band is the best thing to do to help protect our customers," said Christopher Budd, Microsoft Security Response Manager.
Microsoft will release the update later today, just over a week before its regular "Patch Tuesday".
26 Comments - Add comment