Fix it Released for Security Advisory 2286198

Enable Workaround


Fix this problem
Microsoft Fix it 50486

NOTE: Applying the Fix it will require a restart of the machine.
​

Disable workaround

Fix this problem
Microsoft Fix it 50487
​

• KB 2286198: Vulnerability in Windows Shell could allow remote code execution
• MSRC Blog Security Advisory 2286198 Updated

An attacker could present a removable drive to the user with a malicious shortcut file, and an associated malicious binary. When the user opens this drive in Windows Explorer, or any other application that parses the icon of the shortcut, the malicious binary will execute code of the attacker’s choice on the victim system. An attacker could also set up a malicious Web site or a remote network share and place the malicious components on this remote location. When the user browses the Web site using a Web browser such as Internet Explorer or a file manager such as Windows Explorer, Windows will attempt to load the icon of the shortcut file, and the malicious binary will be invoked. In addition, an attacker could embed an exploit in a document that supports embedded shortcuts or a hosted browser control (such as but not limited to Microsoft Office documents).

Click to expand...

Impact of workaround. Disabling icons from being displayed for shortcuts prevents the issue from being exploited on affected systems. When this workaround is implemented, the system may display most icons as a "white" default object icon, which does impact usability. We recommend that system administrators test this workaround thoroughly prior to deployment. When the workaround is undone, all icons will reappear.

Click to expand...

Win7User512 said:

Captain, where have you been? I haven't seen you around lately. Either case, good to see you.

Click to expand...

When this workaround is implemented, the system may display most icons as a "white" default object icon, which does impact usability.

Click to expand...

Microsoft may have a tough time fixing the Windows shortcut vulnerability, a security researcher said today.
A noted vulnerability expert, however, disagreed, and said Microsoft could deliver a patch within two weeks.
"The way Windows' shortcuts are designed is flawed, and I think they will have a very hard time patching this," said Roel Schouwenberg, an antivirus researcher with Moscow-based Kaspersky Lab.
Schouwenberg based his prediction that a patch may prove elusive on the fact that Microsoft has never faced a security issue with shortcuts, and thus has no security processes in place that it can quickly tweak.

Click to expand...

"This may take them awhile to patch," said Schouwenberg. "But the wider-scale use of this is imminent."

Click to expand...

Phone Man said:

I implemented the MS fix and verified the REG entries. It does NOT effect your current desktop or taskbar icons. It will however blank any NEW shortcut icons that are added to the desktop or taskbar. Here is a snip from my desktop with existing CCleaner shortcut (it did not change) and new CCleaner shortcut (new one now blank)

View attachment 87114

In the start menu under all programs, ALL the icons are now blank.
Not a big deal unless you are making lots of changes to the desktop or taskbar.

I will leave it SAFE for now and see when the fix comes out.

Jim

Click to expand...

Phone Man said:

I think it just get exploited when a new shortcut icon is created and the fix turns off some of that process. I have to trust MS that this temp fix will stop the exploit.

Click to expand...

Phone Man said:

Reminds me of the story where a guy is walking down the street snapping his fingers. Another guy asks him what he is doing. First guy said it keeps the elephants away. Second guy says, there are no elephants around here. First guy replies, its works pretty good.

Click to expand...