Computer Security FAQ

Microsoft Releases a “Fix It” Tool for .LNK Vulnerability

DougMorris — Thu, 22 Jul 2010 03:51:10 +0000

Microsoft updated a security advisory warning users of a critical .LNK vulnerability with an automated “Fix It” tool that serves as a stop gap until the company issues a patch.

Microsoft implemented the “Fix It” tool in an attempt to temporarily plug the security hole and prevent existing attacks that are already exploiting the vulnerability by disabling some icons from being displayed linked to shortcut files.

A shortcut is a link, represented by an icon and connected with the LNK extension, that connects a user to a specific file or program, intended to keep frequently accessed files in an easy-to-reach location. Disabling the shortcut icons would subsequently display icons as ‘white” default icons, and prevent malware from exploiting the vulnerability in attacks, although it wouldn’t impact usability.

Microsoft Icon Vulnerability

DougMorris — Tue, 20 Jul 2010 06:01:43 +0000

Security professionals are expressing concern that Microsoft’s recent security advisory about a current Windows vulnerability is misleading. Researchers say users don’t need to click on malicious icons in order to trigger malware exploiting the flaw, which is already in the wild and has already been the subject of attacks.

All you need to do is open a device/network share/WebDav point that has a malicious shortcut, and the vulnerability is exploited! It will run whatever code you program it to run. It is really simple to exploit. Any criminal with basic skills can take advantage of this flaw. We have not seen much activity in the wild yet, but now that a proof of concept has been posted on the web it most likely will become a major issue in the near future.

Computer Security FAQ

DougMorris — Mon, 19 Jul 2010 19:37:45 +0000

Thanks for visiting Computer Security FAQ! Free registration is required to contribute to the discussion and users must be logged in to add comments. Visit our comprehensive Computer Security FAQ section for basic advise on how to stay safe on the Internet!

Looking for answers to your Computer Forensics FAQ? Ask Computer Forensics questions and get answers at ComputerForensicsFAQ.com!