Microsoft Releases Out-Of-Band Security Fix

Microsoft is releasing an out-of-band patch for a Windows security vulnerability that attackers have been targeting for the past few weeks.

The bug – a vulnerability in the Windows shell component that attackers have been exploiting via malicious .LNK files – has increasingly become the target of exploits. In light of the attacks, Microsoft announced it is planning to push out a patch on 2 August.

“We are releasing the bulletin as we’ve completed the required testing and the update has achieved the appropriate quality bar for broad distribution to customers,” blogged Christopher Budd, senior security response communications manager at Microsoft. “Additionally, we’re able to confirm that, in the past few days, we’ve seen an increase in attempts to exploit the vulnerability.”

Attacking .LNK files

The vulnerability at the centre of the attacks exists due to the way Windows parses .LNK shortcut files. More specifically, the Windows Shell component fails to correctly validate specific parameters of the shortcut.

If the user opens an infected USB drive in Windows Explorer or any other program that parses the shortcut icon, malware can be executed. In addition, Microsoft has warned that an attacker could set up a malicious website or a remote network share and place the malicious component there.

The malware first associated with the vulnerability was Stuxnet, which targets Siemens software used by industrial companies. Siemens began distributing a tool on 22 July to help organisations thwart attacks.

“We firmly believe that releasing the update out of band is the best thing to do to help protect our customers,” Budd wrote.