Microsoft Issues Out-of-Band Patch for Windows Shortcut Flaw

Microsoft issued a "critical" out-of-band patch Monday for its previously disclosed Windows Shell vulnerability.

The patch covers every supported Windows operating system, including Windows XP Service Pack 3, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.

Microsoft said that the vulnerability, discovered as a zero-day threat, is "currently being exploited in malware attacks."

"With such a high-profile vulnerability--one that first gained notoriety due to the Stuxnet threat--Microsoft obviously made this a high priority," said Ben Greenbaum, senior research manager at Symantec Security Response, in a released statement. Since then, other variants have emerged such as "Changeup," which can distribute the Tidserv trojan, Greenbaum said. The vulnerability has also been associated with Sality.AT and Chymine malware droppers, Microsoft has said.

Windows Shell is a graphic interface component of Windows and works with .LNK files to create shortcut icons enabling quick access to program files. According to earlier reports, the in-the-wild exploits can be unknowingly triggered when users click on "specially crafted shortcut" icons located on a removable USB drive. Even if users do not click on the shortcut icons, the exploit can still be triggered, according to Microsoft.

Microsoft responded fairly quickly to fix this Windows Shell flaw. The patch came after Microsoft issued a security advisory in late July with a workaround that disables .LNK and .PIF file functionality. The workaround can still be found in this Knowledge Base article.

The company issued this security update shortly before its regular monthly Patch Tuesday, which is scheduled for Aug. 10. The quick turnaround for the out-of-band patch happened because of the increasing number of reported attacks that used the .LNK flaw, according to security expert Wolfgang Kandek, CTO at Qualys. He also noted that the exploit can occur through other means than leveraging shortcut files.

"Remote attacks through e-mail or Web sites are theoretically possible, but require multiple steps and user interaction," Kandek added. "Nevertheless disabling SMB (Sever Message Block) and WebDav (Web-based Distributed Authoring and Versioning) protocols in the outbound rule set of Internet-facing firewalls is a measure that provides additional protection against the remote attack vector."

Kandek pointed out that Windows 2000 and XP SP2 users will not be covered by the patch despite the fact the vulnerability has lasting effects on those systems and their users. Support for those OSes was discontinued in July. To address the vulnerabilities, he recommends that users and administrators upgrade their operating systems to supported versions.

Meanwhile, Kandek suggested that just using the workaround was not the optimal choice. The workaround could affect the "usability of the system as desktop icons are all replaced by standard generic representations and navigation is hampered." Given those conditions, he said it's just best to patch the system or upgrade the OS.

Microsoft said it plans to distribute the patch through the automatic update feature of Windows. Symantec suggested that the vulnerability should be quickly patched.

"The .LNK vulnerability is quite trivial to exploit," Greenbaum explained. "So despite a fix being issued, I don't think we've seen the last piece of malware seeking to take advantage of it. Computer users and IT administrators would do well to patch this one right away."

Jason Miller, data and security team leader at Shavlik Technologies, noted that IT pros should remove the workaround after applying Microsoft's patch. "If you have applied the workarounds suggested by Microsoft, you should remove them as soon as your systems are patched," he said in a prepared statement. Miller also noted that Apple's Safari browser requires attention this month. "Apple released a security update last Thursday addressing 15 vulnerabilities," he noted.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

Featured

  • The AI Show

    Register for Free to Attend the World's Greatest Show for All Things AI in EDU

    The AI Show @ ASU+GSV, held April 5–7, 2025, at the San Diego Convention Center, is a free event designed to help educators, students, and parents navigate AI's role in education. Featuring hands-on workshops, AI-powered networking, live demos from 125+ EdTech exhibitors, and keynote speakers like Colin Kaepernick and Stevie Van Zandt, the event offers practical insights into AI-driven teaching, learning, and career opportunities. Attendees will gain actionable strategies to integrate AI into classrooms while exploring innovations that promote equity, accessibility, and student success.

  • laptop displaying a red padlock icon sits on a wooden desk with a digital network interface background

    Reports Point to Domain Controllers as Prime Ransomware Targets

    A recent report from Microsoft reinforces warns of the critical role Active Directory (AD) domain controllers play in large-scale ransomware attacks, aligning with U.S. government advisories on the persistent threat of AD compromise.

  • laptop displaying a glowing digital brain and data charts sits on a metal shelf in a well-lit server room with organized network cables and active servers

    Cisco Unveils AI-First Approach to IT Operations

    At its recent Cisco Live 2025 event, Cisco introduced AgenticOps, a transformative approach to IT operations that integrates advanced AI capabilities to enhance efficiency and collaboration across network, security, and application domains.

  • educators seated at a table with a laptop and tablet, against a backdrop of muted geometric shapes

    HMH Forms Educator Council to Inform AI Tool Development

    Adaptive learning company HMH has established an AI Educator Council that brings together teachers, instructional coaches and leaders from school district across the country to help shape its AI solutions.