Microsoft 0-day Malformed Shortcut (.lnk file) Vulnerability

This may not be breaking news for many. Brian Krebs posted this on his blog last Thursday, Microsoft published the advisory last Friday and followed it up with an update on Tuesday, where they mentioned


Microsoft is currently working to develop a security update for Windows to address this vulnerability.


This post is not about the vulnerability but an interesting observation from the Microsoft announcement. As you can see below, they have omitted Windows XP and SP2 from this, it may not be a surprise as the support for XP SP2 ended on July 13.

It will be interesting to see if Microsoft does come up with a patch since the vulnerability announcement and the support end date were very close and the fact that this is a critical vulnerability.

As for this specific vulnerability mitigation for large organizations, I recommend software restriction policies (SRP), there is an interesting article by Didier here on this topic. More information on SRP is available here.