Microsoft Issues Temporary Fix for Shortcut Flaw

Microsoft has issued an automated workaround for a Windows shortcut flaw that security researchers yesterday flagged with a yellow alert. The workaround is a temporary measure while the company works furiously to provide a more permanent patch.

The Windows shortcut flaw affects files with the .LNK extension (otherwise known as "shortcut files"). The zero-day vulnerability could allow cyber criminals to seize control of victim PCs. A similar and more public version of the exploit affected Siemens industrial automated systems just last week.

Temporary Fix Alters Icons, Leaving them Blank

Microsoft issued a temporary "Fix It" this past Tuesday evening, five days after the vulnerability -- which reportedly affects every version of Windows from XP to Win 7 -- became known.

The temporary Microsoft fix automatically alters settings within Windows to protect users until a patch becomes available. The next chance for that is the August Patch Tuesday, but some security experts doubt Microsoft will be able to develop a permanent fix by that time. (Source: theregister.co.uk)

Christopher Budd, Microsoft's Security Response Communications lead, says that the workaround disables icons and recommends IT administrators test the fix before deploying it across all applicable PCs. The temporary patch alters folder and file icons and in the process removes their graphical representations, leaving blank, white boxes in their place. (Source: computerworld.com)

Flaw's Threat Grows Beyond USB

Up until recently, security experts believed the only way for user systems to become infected was through a hacked USB stick. Now, it seems the flaw can be remotely administered and exploited via local network file sharing features of the Web Distributed Authoring and Versioning client service, known as WebDAV.

Microsoft's next Patch Tuesday is set for August 10, but the company hasn't confirmed whether it will release a permanent fix for this issue at that time.

Download and Apply Windows Shortcut Flaw Temporary Fix

The fix is available via Microsoft's website. Once the temporary fix is applied, all shortcut icon images will be replaced by a blank square. An example is included in the link below.

http://support.microsoft.com/kb/2286198