Microsoft Windows Shortcut 'LNK/PIF' Files Automatic File Execution Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to view an icon of a maliciously crafted shortcut file.

This issue is being exploited in the wild with W32.Stuxnet (previously known as W32.Temphid).

Immunity has released the following exploit to members of the Immunity Partners program:

https://www.immunityinc.com/downloads/immpartners/winshell_lnk.tar.gz

The following exploits are available:

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.


 

Privacy Statement
Copyright 2010, SecurityFocus