Software giant Microsoft today announced that it will start issuing an emergency patch for the critical Windows shortcut bug from August 2. Microsoft added that the quality of the "out-of-band" update is satisfactory. The company also admitted that the attacks have increased recently. "In the past few days, we've seen an increase in attempts to exploit the vulnerability," Christopher Budd, a spokesman for the Microsoft Security Response Center, wrote on the team's blog. "We firmly believe that releasing the update out of band is the best thing to do to help protect our customers," he added.
Budd noted that the patch would be released at approximately 1 p.m. Eastern on Monday. Two weeks ago, Microsoft acknowledged that their is a flaw in how Windows parses shortcut files, the small files which are displayed by icons on the desktop, on the toolbar and in the Start menu.
A small Belarussian firm VirusBlokAda had identified the bug in mid-June. The bug however, attracted widespread attention on July 15, after security blogger Brian Krebs reported on it. On July 16, Microsoft confirmed the flaw and admitted that attackers were already exploiting it using the "Stuxnet" worm. The flaw is serious because it gives an opportunity to the hackers to target Windows PCs that manage large-scale industrial-control systems in manufacturing and utility firms.
The Microsoft group, which develops malware signatures to defend customers using the company's antivirus products said that exploits of the unpatched shortcut flaw have now been added to an especially nasty malware family. "Sality is a highly virulent strain ... known to infect other files, making full removal after infection challenging, copy itself to removable media, disable security, and then download other malware," wrote Holly Stewart of the Microsoft Malware Protection Center, on the group's blog yesterday. "It is also a very large family -- one of the most prevalent families this year," added Stewart
