Microsoft issued an unexpected security bulletin late last week for a critical flaw in the Windows shell that can lead to exploitation when removable media is inserted into a PC - and despite acknowledging that the vulnerability is being attacked, isn't planning an out-of-cycle patch.
The flaw is described over on Neowin as affecting the way that the Windows shell handles .lnk files - used to signify a shortcut to another file. If a removable storage device is connected to a system with AutoRun or AutoPlay enabled - or if the device is opened manually in Windows Explorer - the flaw is triggered and code is executed.
The vulnerability is particularly concerning, as it affects all current versions of Windows - including Windows 7 - and bypasses protections such as UAC designed to prevent exactly this kind of attack. Worse still, the vulnerability can potentially be exploited over WebDAV or network shares - with no physical access to the machine required.
Despite this, Microsoft's security bulletin regarding the issue is silent on when a fix is to be expected - despite the company acknowledging that the flaw is being actively exploited in what it claims are "limited, targeted attacks." Without an out-of-cycle patch for the flaw, the earliest the issue could be resolved is on Tuesday the 10th of August - the company's next Patch Tuesday.
So far, the only work-around offered by Microsoft for the issue is to disable icons for shortcuts - which makes everything a whole lot uglier, but should protect your system from attack.
Do you believe that this flaw is serious enough to warrant an out-of-cycle patch, or is the likelihood of you browsing to an affected share or using a malicious storage device so slim you're willing to wait for an in-cycle fix? Share your thoughts over in the forums.
The flaw is described over on Neowin as affecting the way that the Windows shell handles .lnk files - used to signify a shortcut to another file. If a removable storage device is connected to a system with AutoRun or AutoPlay enabled - or if the device is opened manually in Windows Explorer - the flaw is triggered and code is executed.
The vulnerability is particularly concerning, as it affects all current versions of Windows - including Windows 7 - and bypasses protections such as UAC designed to prevent exactly this kind of attack. Worse still, the vulnerability can potentially be exploited over WebDAV or network shares - with no physical access to the machine required.
Despite this, Microsoft's security bulletin regarding the issue is silent on when a fix is to be expected - despite the company acknowledging that the flaw is being actively exploited in what it claims are "limited, targeted attacks." Without an out-of-cycle patch for the flaw, the earliest the issue could be resolved is on Tuesday the 10th of August - the company's next Patch Tuesday.
So far, the only work-around offered by Microsoft for the issue is to disable icons for shortcuts - which makes everything a whole lot uglier, but should protect your system from attack.
Do you believe that this flaw is serious enough to warrant an out-of-cycle patch, or is the likelihood of you browsing to an affected share or using a malicious storage device so slim you're willing to wait for an in-cycle fix? Share your thoughts over in the forums.
MSI MPG Velox 100R Chassis Review
October 14 2021 | 15:04
Want to comment? Please log in.