Microsoft Issues Out-of-Band Patch for Windows Shortcut Flaw

• By Jabulani Leffall
• 08/05/10

Microsoft issued a "critical" out-of-band patch Monday for its previously disclosed Windows Shell vulnerability.

The patch covers every supported Windows operating system, including Windows XP Service Pack 3, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.

Microsoft said that the vulnerability, discovered as a zero-day threat, is "currently being exploited in malware attacks."

"With such a high-profile vulnerability--one that first gained notoriety due to the Stuxnet threat--Microsoft obviously made this a high priority," said Ben Greenbaum, senior research manager at Symantec Security Response, in a released statement. Since then, other variants have emerged such as "Changeup," which can distribute the Tidserv trojan, Greenbaum said. The vulnerability has also been associated with Sality.AT and Chymine malware droppers, Microsoft has said.

Windows Shell is a graphic interface component of Windows and works with .LNK files to create shortcut icons enabling quick access to program files. According to earlier reports, the in-the-wild exploits can be unknowingly triggered when users click on "specially crafted shortcut" icons located on a removable USB drive. Even if users do not click on the shortcut icons, the exploit can still be triggered, according to Microsoft.

Microsoft responded fairly quickly to fix this Windows Shell flaw. The patch came after Microsoft issued a security advisory in late July with a workaround that disables .LNK and .PIF file functionality. The workaround can still be found in this Knowledge Base article.

The company issued this security update shortly before its regular monthly Patch Tuesday, which is scheduled for Aug. 10. The quick turnaround for the out-of-band patch happened because of the increasing number of reported attacks that used the .LNK flaw, according to security expert Wolfgang Kandek, CTO at Qualys. He also noted that the exploit can occur through other means than leveraging shortcut files.

"Remote attacks through e-mail or Web sites are theoretically possible, but require multiple steps and user interaction," Kandek added. "Nevertheless disabling SMB (Sever Message Block) and WebDav (Web-based Distributed Authoring and Versioning) protocols in the outbound rule set of Internet-facing firewalls is a measure that provides additional protection against the remote attack vector."

Kandek pointed out that Windows 2000 and XP SP2 users will not be covered by the patch despite the fact the vulnerability has lasting effects on those systems and their users. Support for those OSes was discontinued in July. To address the vulnerabilities, he recommends that users and administrators upgrade their operating systems to supported versions.

Meanwhile, Kandek suggested that just using the workaround was not the optimal choice. The workaround could affect the "usability of the system as desktop icons are all replaced by standard generic representations and navigation is hampered." Given those conditions, he said it's just best to patch the system or upgrade the OS.

Microsoft said it plans to distribute the patch through the automatic update feature of Windows. Symantec suggested that the vulnerability should be quickly patched.

"The .LNK vulnerability is quite trivial to exploit," Greenbaum explained. "So despite a fix being issued, I don't think we've seen the last piece of malware seeking to take advantage of it. Computer users and IT administrators would do well to patch this one right away."

Jason Miller, data and security team leader at Shavlik Technologies, noted that IT pros should remove the workaround after applying Microsoft's patch. "If you have applied the workarounds suggested by Microsoft, you should remove them as soon as your systems are patched," he said in a prepared statement. Miller also noted that Apple's Safari browser requires attention this month. "Apple released a security update last Thursday addressing 15 vulnerabilities," he noted.