Posted on Monday, August 02 2010 @ 17:22 CEST by Thomas De Maesschalck
Microsoft reports it will issue today an out-of-band security update to plug a critical .lnk file format vulnerability that enables attackers to execute malicious code when the icon of a specially crafted shortcut is displayed. The software giant originally planned to release the update on next week's Patch Tuesday but an increase in attempts to exploit the vulnerability has prompted Microsoft to release the update as soon as possible.
Because of the seriousness of the flaw, Microsoft has decided to publish the patch before the company's scheduled release of security patches Aug. 10. The so-called "out of band" release corrects a flaw that results in Windows incorrectly parsing shortcuts in a way that allows malicious code to be executed when the icon of a specially crafted shortcut is displayed, the company said.
"We're able to confirm that, in the past few days, we've seen an increase in attempts to exploit the vulnerability," Christopher Budd, spokesman for the Microsoft Security Response Center, said Friday. "We firmly believe that releasing the update out of band is the best thing to do to help protect our customers."
Source: Information Week
