Microsoft to release fix for Windows Shortcut flaw on Monday

[Airbot]

Microsoft has announced plans to release of an out-of-band update on Monday to address the Windows Shortcut flaw revealed less than two weeks ago. The software giant has been keeping a close watch on the use of .LNK files exploiting the vulnerability and has concluded that it needs to act faster than usual.

more..

 

[NoN]

Hope it will not be the same as already told here:
http://www.sevenforums.com/news/98814-fix-released-security-advisory-2286198-a.html

 

[Airbot]

Hope it will not be the same as already told here:
http://www.sevenforums.com/news/98814-fix-released-security-advisory-2286198-a.html

That's just a workaround, not an update (fix).

 

[Wii Master 64]

Good to know.

 

[JMH]

MS preps emergency patch for Windows shortcut peril

Warning of an uptick in attacks, Microsoft plans to issue an emergency update to patch a critical Windows vulnerability that hackers are exploiting to seize control of PCs.

The patch, which fixes the way Windows parses shortcut icons, will be released on Monday at around 10 a.m. California time. It comes two weeks after reports surfaced that unknown hackers were exploiting the flaw in an attempt to install malware on systems that control the operations of power plants and other critical infrastructure. At least two customer of SCADA, or supervisory control and data acquisition, software offered by Siemens have been hit by a computer worm that exploits the bug.

“We are releasing the bulletin as we've completed the required testing and the update has achieved the appropriate quality bar for broad distribution to customers,” Christopher Budd, Microsoft's senior security response communications manager,” wrote. “Additionally, we're able to confirm that, in the past few days, we've seen an increase in attempts to exploit the vulnerability. We firmly believe that releasing the update out of band is the best thing to do to help protect our customers.”

More -
MS preps emergency patch for Windows shortcut peril • The Register

 

[CarlTR6]

Thank you for the info, Aaron and Jan. That is one I want to make sure I install.

 

[A Guy]

Microsoft rushes fix for Windows shortcut hole

Microsoft plans to release a patch on Monday for a flaw involving how Windows handles shortcut files, after seeing the hole being used to spread a particularly nasty and fast-spreading virus, the company said Friday.

Initially, the Windows flaw was used to spread the Stuxnet worm via USB drives. The vulnerability, which is in all versions of Windows, is in the code that processes shortcut files ending in ".lnk," according to the Microsoft advisory from two weeks ago that included information on a work-around.

Now there are copycat attacks in which the .lnk hole, or "shortcut hole," is being used in combination with a virus dubbed "Sality.AT," which has spread faster than the Stuxnet worm, Microsoft said in a Microsoft Malware Protection Center blog post.

Story Here

A Guy

 

[Win7User512]

So this is it? This is gonna be THE patch? I just want to know so I don't miss it.

 

[Borg 386]

Thanx for the info.

The only question I have: is it going to undo the temp fix they issued (if you applied it) or will we have to do that ourselves....guess we'll find out

 

[Petey7]

So, in three more hours we'll have a fix. That was unusually quick, I think.

 

[Win7User512]

Thanx for the info.

The only question I have: is it going to undo the temp fix they issued (if you applied it) or will we have to do that ourselves....guess we'll find out

There should be a KB (knowledge base) web page associated with the fix. I would expect that to answer your question.

 

[Borg 386]

Nope...I just installed it...it did not fix them

 

[Airbot]

Microsoft Security Bulletin MS10-046 - Critical: Vulnerability in Windows Shell Could Allow Remote Code Execution (2286198)

 

[NICK ADSL UK]

Microsoft Out-Of-Band Security Bulletin(s) - August 2, 2010

Microsoft Out-Of-Band Security Bulletin(s) - August 2, 2010
Note: There may be latency issues due to replication, if the page does not display keep refreshing
Today Microsoft released the following Out-of-Band Security Bulletin(s).

Bulletin Summary:
Microsoft Security Bulletin Summary for August 2010

Critical (1)
Microsoft Security Bulletin MS10-046
Vulnerability in Windows Shell Could Allow Remote Code Execution (2286198)
http://www.microsoft.com/technet/security/bulletin/ms10-046.mspx

 

[Win7User512]

Nope...I just installed it...it did not fix them

From the KB article:

How to undo the workaround.
To re-enable the WebClient Service, follow these steps:
1.
Click Start, click Run, type Services.msc and then click OK.
2.
Right-click WebClient service and select Properties.
3.
Change the Startup type to Automatic. If the service is not running, click Start.
4.
Click OK and exit the management application.

 

[Borg 386]

Thank you everyone....I just went ahead and used the MS Undo Fix program.

Everything looks swell again

(I knew I had it on the HD somewhere)

 

[BugOutMachine]

Update Available KB2286198

Microsoft Security Bulletin MS10-046 - Critical: Vulnerability in Windows Shell Could Allow Remote Code Execution (2286198)

 

[Luckystar]

Well i just installed the update and although it took a while to bring my desktop up (Had to do a ctrl+alt+del and start task manager), all seems fine and my shortcuts still work fine.

Lucky.

 

[BugOutMachine]

Thank you Microsoft!

I also installed the update for x64. The funny thinks is that they call the fix "Important" even though it's "Critical".

Security Update for Windows 7 for x64-based Systems (KB2286198)

Installation date: ‎8/‎2/‎2010 2:50 PM

Installation status: Successful

Update type: Important

A security issue has been identified that could allow an unauthenticated remote attacker to compromise your system and gain control over it. You can help protect your system by installing this update from Microsoft. After you install this update, you may have to restart your system.

More information:
Microsoft Security Bulletin MS10-046 - Critical: Vulnerability in Windows Shell Could Allow Remote Code Execution (2286198)

Help and Support:
Microsoft Support

 

[Corrine]

If you installed the work around provided by Microsoft Fix 50486, you can undo the changes made by the Fix it solution by using Microsoft Fix it 50487 available in Microsoft KB 2286198.