Microsoft Releases Out-of-Band Security Update to Address Windows Shortcut Exploit aka CPLINK

If you like this article, please share it with your friends and contacts on Google Plus, Facebook and Twitter using following buttons so that they can also enjoy the article:

Windows Shortcut Exploit, also known as CPLINK, is a zero-day vulnerability in all versions of Windows that allows a Windows shortcut link, known as an .lnk file, to run a malicious DLL file. The dangerous shortcut links can also be embedded on a website or hidden within documents.

The exploit works when you open a device, network share or WebDav point carrying an infection—you don't need to click on anything for the exploit to work, even if you have AutoPlay and AutoRun disabled.

There was no patch from Microsoft to fix this exploit but now Microsoft has released an out-of-band security update to address this exploit.

According to Microsoft Security Bulletin, this security update resolves the vulnerability in Windows Shell. The vulnerability could allow remote code execution if the icon of a specially crafted shortcut is displayed. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

For users using automatic updates, this update will automatically be applied once it is released. Users not using automatic updates should download, test and deploy this update as quickly as possible.

Download Links:

Other similar articles that may interest you:

This article was posted by VG in following section: Windows 7, Windows Vista, Windows XP.

If you enjoyed this article, you can subscribe to our RSS feed or free newsletter to get all new articles directly in your Inbox. Also check out our most popular articles and archive to read other interesting articles. If you have some news or tip to share, please send us.

Have You Checked Out Following Popular Articles?

Astitva

what it does???
Someone

Not clear. What is problem with Windows anyway.
MuTz777

Hurray! No more Sophos! (I hope my spelling is correct!)
Finally microsoft released the patch.
G.H

after apply the fix and restart,my pc just freeze at "Windows is configuring updates" but the bar still moving ......any help?
Bob

You said it's am "out-of-band" security update...what does that mean? :S
SCBright

Received today (03/Aug/2010) via WU.
MuTz777

VG, getting same prob as G.H on Win7 x86.
The fix worked on Windows Server 2008, but I don't think I installed Sophos on it .

@G.H did u install Sophos before?
I think Sophos has messed up the PC.

And how do you get rid of the update, cos the status says restart pending even though the update failed.

Till then using sophos...
G.H

Nope,i uses Eset Nod32
MuTz777

Then no idea. VG, your powerful skill is needed! HELP!
VG

I have not seen anyone facing problems after installing this update, so can't help much. But you can try to start your system in Safe Mode and then uninstall the update using Programs and Features in Control Panel.