Microsoft To Release Emergency Patch For WindowsMicrosoft To Release Emergency Patch For Windows
The "out of band" emergency update addresses a Windows vulnerability that is being exploited by attackers using a "highly virulent strain" of malware.
July 30, 2010

Microsoft plans to release on Monday an emergency fix for a Windows vulnerability that is being exploited by attackers using a "highly virulent strain" of malware.
Because of the seriousness of the flaw, Microsoft has decided to publish the patch before the company's scheduled release of security patches Aug. 10. The so-called "out of band" release corrects a flaw that results in Windows incorrectly parsing shortcuts in a way that allows malicious code to be executed when the icon of a specially crafted shortcut is displayed, the company said.
"We're able to confirm that, in the past few days, we've seen an increase in attempts to exploit the vulnerability," Christopher Budd, spokesman for the Microsoft Security Response Center, said Friday. "We firmly believe that releasing the update out of band is the best thing to do to help protect our customers."
According to the Microsoft Malware Protection Center, attackers have used .LNK files to exploit the vulnerability. As malware writers have learned of the flaw, multiple techniques to exploit it are showing up on the Internet.
One family of viruses, called Sality, has caught the attention of security researchers, who have spotted a newly developed member Sality.AT that exploits the latest vulnerability.
"Sality is a highly virulent strain," the Protection Center says in its blog. "It is known to infect other files, making full removal after infection challenging, copy itself to removable media, disable security and then download other malware."
With the release of Sality.AT, developers of other virus families will likely move quickly to copy the technique to target the same vulnerability, the center said.
Affected versions of Windows include Windows 7, XP, Server 2003, Vista and Server 2008. Microsoft has posted a detailed list.
Read more about:
2010About the Author(s)
You May Also Like
Modern Supply Chain Security: Integrated, Interconnected, and Context-Driven
Nov 06, 2023How to Combat the Latest Cloud Security Threats
Nov 06, 2023Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and Phishing
Nov 01, 2023SecOps & DevSecOps in the Cloud
Nov 06, 2023What's In Your Cloud?
Nov 30, 2023