Microsoft Releasing Windows .LNK Security Fix Early

Microsoft is patching a Windows vulnerability being targeted by attackers. The zero-day bug was disclosed publicly this month.

Microsoft is releasing an out-of-band patch for a Windows security vulnerability that attackers have been targeting for the past few weeks.

The bug – a vulnerability in the Windows shell component attackers have been exploiting via malicious .LNK files – has increasingly become the target of exploits. In light of the attacks, Microsoft announced it is planning to push out a patch Monday, Aug. 2.

“We are releasing the bulletin as we’ve completed the required testing and the update has achieved the appropriate quality bar for broad distribution to customers,” blogged Christopher Budd, senior security response communications manager at Microsoft. “Additionally, we’re able to confirm that, in the past few days, we’ve seen an increase in attempts to exploit the vulnerability.”

The vulnerability at the center of the attacks exists due to the way Windows parses .LNK shortcut files. More specifically, the Windows Shell component fails to correctly validate specific parameters of the shortcut.

If the user opens an infected USB drive in Windows Explorer or any other program that parses the shortcut icon, malware can be executed. In addition, Microsoft has warned that an attacker could set up a malicious Website or a remote network share and place the malicious component there.

The malware first associated with the vulnerability was Stuxnet, which targets Siemens software used by industrial companies. Siemens began distributing a tool July 22 to help organizations thwart attacks.

“We firmly believe that releasing the update out of band is the best thing to do to help protect our customers,” Budd wrote.