Update: Microsoft Security Advisory (2286198)

ronjor · Jul 16, 2010

Published: July 16, 2010

Version: 1.0
General Information
Executive Summary

Microsoft is investigating reports of limited, targeted attacks exploiting a vulnerability in Windows Shell, a component of Microsoft Windows. This advisory contains information about which versions of Windows are vulnerable as well as workarounds and mitigations for this issue.

The vulnerability exists because Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the user clicks the displayed icon of a specially crafted shortcut. This vulnerability is most likely to be exploited through removable drives. For systems that have AutoPlay disabled, customers would need to manually browse to the root folder of the removable disk in order for the vulnerability to be exploited. For Windows 7 systems, AutoPlay functionality for removable disks is automatically disabled.

We are actively working with partners in our Microsoft Active Protections Program (MAPP) to provide information that they can use to provide broader protections to customers.

Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers.
Click to expand...

Microsoft

Page42 · Jul 16, 2010

Re: Microsoft Security Advisory (228619

Thanks for that, Ron.
Worth noting in the MS Advisory... "This vulnerability is most likely to be exploited through removable drives."

ronjor · Jul 18, 2010

Re: Microsoft Security Advisory (228619

A PoC that exploits this vulnerability has been posted today. I would recommend everyone to take a look at Microsoft's advisory that is available at http://www.microsoft.com/technet/security/advisory/2286198.mspx, especially the workarounds section ("Disable the displaying of icons for shortcuts").
Click to expand...

SANS.....

ronjor · Jul 20, 2010

Re: Microsoft Security Advisory (228619

Security Advisory 2286198 Updated

We've just updated Microsoft Security Advisory 2286198 to let customers know that we now have an automated "Fix It" available to implement the workaround we first outlined in our original posting on Friday, July 16, 2010. More information is available in the KB article 2286198, but in summary running the "Fix It" can help prevent attacks attempting to exploit this vulnerability. This workaround will disable some icons from being displayed so we recommend administrators test this before deploying it widely.

We've also updated the advisory with new information regarding possible attack vectors. Finally, we have included a new workaround that customers can implement to help protect their environments: blocking the download of LNK and PIF files (note that these files can be transferred over WebDav, so be sure to account for this protocol if you implement this workaround).
Click to expand...

Microsoft

wearetheborg · Jul 21, 2010

Thanks; this is a serious hole !!!!

tgell · Jul 22, 2010

From Trendmicro's blog:

Exploits for the recently discovered Windows shortcut vulnerability are now fully out in the wild and affecting users. While earlier samples were seen in more narrowly targeted attacks, the new samples seen by Trend Micro analysts are now aimed at broader audiences and now pose a threat to users at large. Indonesia and India have been particularly hard-hit by this attack, accounting for more than 75% of the seen infections.

In addition, a recent update to Microsoft’s advisory has added a new vector for this vulnerability. File formats that support embedded shortcuts (such as Microsoft Office documents) can now be used to spread exploits as well. This means that users who download and open such files would find themselves the latest victim of this vulnerability. It has also been reported that this attack could be used in drive-by attack scenarios, further raising the risk.
Click to expand...

arleetel · Jul 22, 2010

Thanks.
Applied the fix.

JRViejo · Jul 22, 2010

The newly discovered malware is "far less sophisticated" than Stuxnet and "suggests bottom feeders seizing on techniques developed by others," said Eset researcher Pierre-Marc Bureau, writing in a blog post.

One of the new samples installs a keystroke logger, a tool hackers use to steal passwords and other data, on the victim's computer. "The server used to deliver the components used in this attack is presently located in the US, but the IP is assigned to a customer in China," Bureau said.

The other variant could be used to install one of several different pieces of malicious software.
Click to expand...

Virus writers are picking up new Microsoft attack By Robert McMillan.

Longboard · Jul 23, 2010

Can Windows kill the Internet?
Harsh but fair ...??
Perhaps a bit OTT ?? or not..
Just another in the l-o-n-g line..??

Fast moving changes!!
Some amelioration available now as noted, imo good response from security companies and quick recognition of extremely serious nature of the threat.

Siemens has coped a battering but other infrastructure at risk too
http://news.google.com/news/story?q...sult&ct=more-results&resnum=4&ved=0CCMQqgIwAw

tesk · Jul 23, 2010

We have developed a tool to detect this exploit inside files.

It is available from here:
http://90plan.ovh.net/~avfsb/index.php?SSP=TELECHARGEMENT6&MENU=1

Let me know if you experience any bugs or anything.

tlu · Jul 23, 2010

A LUA/SRP combo protects against this thread as expected.

MrBrian · Jul 26, 2010

SophosLabs Released Free Tool to Validate Microsoft Shortcut

Konata Izumi · Jul 29, 2010

tlu said:

A LUA/SRP combo protects against this thread as expected.
Click to expand...

LOL. LUA/SRP ftw!

PunchsucKr · Aug 2, 2010

Konata Izumi said:

LOL. LUA/SRP ftw!
Click to expand...

+1 to that!!

http://blogs.technet.com/b/msrc/arc...ress-microsoft-security-advisory-2286198.aspx

^^ apparently they're releasing the fix now.

oops dint see the whole other thread for this info... how stupid of me to think nobody here saw that

JRViejo · Aug 3, 2010

Although some had hoped that Microsoft would violate its own patching policy, the company yesterday stuck to its guns and declined to provide a fix for a critical bug to users running Windows XP Service Pack 2 (SP2).

On Monday, Microsoft shipped an emergency patch for the Windows shortcut bug that attackers have been exploiting for several weeks. The vulnerability affects all versions from Windows 2000 on, including XP, Vista and Windows 7.

But, per Microsoft's practice, the oldest operating systems and service packs were denied the update.

"To be crystal clear, there is no security update for XP SP2," said Microsoft spokesman Christopher Budd in a Webcast on the out-of-band patch that he hosted Monday afternoon.
Click to expand...

Microsoft sticks to plan, denies emergency patch for XP SP2 by Gregg Keizer.

elapsed · Aug 3, 2010

Good, if you make a proposal you should stick by it, otherwise it's meaningless, and people will never upgrade due to thinking "if it's critical enough for me to care, they'll give us a patch", instead of upgrading.

PunchsucKr · Aug 4, 2010

Just one question comes to mind... why wont somebody apply sp3 which is offered by windows update as well!?

Log in or Sign up

Update: Microsoft Security Advisory (2286198)

ronjor Global Moderator

Page42 Registered Member

ronjor Global Moderator

ronjor Global Moderator

wearetheborg Registered Member

tgell Registered Member

arleetel Registered Member

JRViejo Super Moderator

Longboard Registered Member

tesk Registered Member

tlu Guest

MrBrian Registered Member

Konata Izumi Registered Member

PunchsucKr Registered Member

JRViejo Super Moderator

elapsed Registered Member

PunchsucKr Registered Member

Log in or Sign up

Update: Microsoft Security Advisory (2286198)

ronjor Global Moderator

Page42 Registered Member

ronjor Global Moderator

ronjor Global Moderator

wearetheborg Registered Member

tgell Registered Member

arleetel Registered Member

JRViejo Super Moderator

Longboard Registered Member

tesk Registered Member

tlu Guest

MrBrian Registered Member

Konata Izumi Registered Member

PunchsucKr Registered Member

JRViejo Super Moderator

elapsed Registered Member

PunchsucKr Registered Member

Useful Searches