Microsoft Attempts To Fix Stuxnet For The Third Time
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2010-2568 | Remote Code Execution in Microsoft Windows via Malicious Shortcut (LNK) Parsing CVE-2010-2568 is an input-validation flaw (CWE-20) in how Microsoft Windows parses shortcut files, allowing malicious code to execute when the operating system merely displays the icon of a malicious shortcut (.lnk) file. Triggering requires nothing more than the Windows shell rendering the shortcut's icon — for example when browsing a folder containing the file, a vector widely abused via USB drives and network shares in incidents tied to Stuxnet and Gauss. A successful attacker gains arbitrary code execution with the privileges of the logged-on user, suitable for initial access or lateral movement. All Microsoft Windows systems as listed by CISA are affected; the provided data does not specify exact version ranges. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2022-09-15), carries a 91.3% EPSS probability of exploitation (100th percentile), and related headlines report Microsoft having to re-issue the fix more than once for Stuxnet-related attacks. Do: Apply Microsoft updates per vendor instructions (CISA's required action); since headlines indicate this LNK fix was re-released multiple times, verify systems carry the latest cumulative Windows updates rather than only the original patch. Until patched, avoid browsing untrusted removable drives or network shares with a shell that renders shortcut icons, and monitor for LNK-delivered malware. | — | 91% | KEV |
| mass≈1 billion+ Windows installations worldwide (unknown share unpatched; legacy versions carry the highest risk) | |
| CVE-2017-8464 | Remote Code Execution in Microsoft Windows Shell via crafted .LNK shortcuts CVE-2017-8464 is a remote code execution flaw in how the Windows Shell handles .LNK shortcut files, evoking the 2010 Stuxnet-era LNK bug that Microsoft had to fix repeatedly. It is triggered when Windows Explorer, or any other application that parses shortcut icons, processes a crafted .LNK file — for example while browsing a USB drive, network share, or downloaded folder — and the CVSS vector requires user interaction but no privileges. A successful attacker can execute arbitrary code in the context of the logged-on user, with high impact on confidentiality, integrity, and availability. Nearly every Windows release in support at disclosure time is affected, spanning Windows 7 SP1, Windows 8/8.1, Windows RT 8.1, Windows 10 (Gold through 1703), and Windows Server 2008 through 2016. Exploitation is confirmed: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-02-10, EPSS assigns a 90% 30-day exploitation probability (100th percentile), public PoCs exist, and headlines tie it to malware campaigns such as Lucifer and BlackSquid. Do: Apply Microsoft security updates per vendor instructions (released with the June 2017 Patch Tuesday and carried forward in later cumulative/rollup updates) on all affected systems, prioritizing legacy Windows 7/8/RT 8.1 and Server 2008/2012/2016 hosts that remain in service, including any under Extended Security Updates. Since CISA lists this as actively exploited, verify patch status fleet-wide and hunt for suspicious .LNK activity; as interim mitigation, be cautious with untrusted removable media, network shares, and downloaded shortcuts, and consider Microsoft's guidance on disabling shortcut icon display. | 8.8 | 90% | KEV PoC ×2 |
| masshundreds of millions of Windows devices |
Full article539 words · extracted from securityaffairs.com · click to collapse
Microsoft released a new security update on June 17th in an attempt to patch a vulnerability which allowed the Stuxnet Virus to exploit Windows systems.
The Stuxnet Virus which attacks Industrial Control Systems was first discovered in 2010 when it infected Iranian Programmable Logic Controllers. Stuxnet compromises controllers by first targeting Windows operating systems and networks. Propagating through infected Windows machines it locates Siemens software used to manage controllers. Stuxnet then collects information on the systems and in the case of the Iranian centrifuges caused them to malfunction, destroying the nuclear material they were enriching.
Attempts by Microsoft to fix the vulnerability did not address how LNK files use attributes to identify folder location. Microsoft’s explanation states LNK files were able to bypass the fix, resulting in a previously an unexpected vulnerability.
Affected Versions include:
- Microsoft Windows 10 Version 1607 for 32-bit Systems
- Microsoft Windows 10 Version 1607 for x64-based Systems
- Microsoft Windows 10 for 32-bit Systems
- Microsoft Windows 10 for x64-based Systems
- Microsoft Windows 10 version 1511 for 32-bit Systems
- Microsoft Windows 10 version 1511 for x64-based Systems
- Microsoft Windows 10 version 1703 for 32-bit Systems
- Microsoft Windows 10 version 1703 for x64-based Systems
- Microsoft Windows 7 for 32-bit Systems SP1
- Microsoft Windows 7 for x64-based Systems SP1
- Microsoft Windows 8.1 for 32-bit Systems
- Microsoft Windows 8.1 for x64-based Systems
- Microsoft Windows RT 8.1
- Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1
- Microsoft Windows Server 2008 R2 for x64-based Systems SP1
- Microsoft Windows Server 2008 for 32-bit Systems SP2
- Microsoft Windows Server 2008 for Itanium-based Systems SP2
- Microsoft Windows Server 2008 for x64-based Systems SP2
- Microsoft Windows Server 2012
- Microsoft Windows Server 2012 R2
- Microsoft Windows Server 2016
Discovering Microsoft’s two previous attempts to fix the vulnerability had failed Microsoft released the June patch to address vulnerability CVE-2017-8464. Microsoft confirmed that the flaw had been exploited in the wild. Exploits for the vulnerability are currently available for Metasploit, with videos available on Youtube on how to exploit the vulnerability.
According to an advisory published by the CERT Coordination Center at Carnegie Mellon University, hackers already know another method for bypassing Microsoft’s patches for the above issue.
“The fix for CVE-2010-2568 and the subsequent fix for CVE-2015-0096 are both insufficient in that they not take into account LNK files that use the SpecialFolderDataBlock or KnownFolderDataBlock attributes to specify the location of a folder. Such files are able to bypass the whitelisting first implemented in the fix for CVE-2010-2568,” CERT/CC said in its advisory.
“By convincing a user to display a specially-crafted shortcut file, an attacker may be able to execute arbitrary code with the privileges of the user. Depending on the operating system and AutoRun/AutoPlay configuration, this can happen automatically by connecting a USB device,”
Additional steps can be taken to prevent the exploitation of this vulnerability by blocking outgoing connections on TCP and UDP ports 139 and 445.
Courtney “Brock” Rabon is KBRwyle’s Cyber Evangelist and has 11 years of experience helping Commercial and Federal clients meet their cyber security goals. He manages their Cyber Security Technologies Lab in Charleston, SC and can be reached at [email protected].
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – Stuxnet, )
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/61701/hacking/microsoft-fix-stuxnet.html