Re: Explorer crashes when it sees this .lnk file

[furrm () KENYON EDU (Mike Furr)]

Parity Error wrote:

> Hi all,
>
> Explorer crashes when it "sees" this .lnk file in a directory. Looks like some
> decoding code for .lnk files crashes when it sees this. The code
> seems to be in a shared dll. U cannot edit this file using any windows based
> hex editor. All apps crash when they see this. This may be exploitable, ....
>
>   ------------------------------------------------------------------------
>                 Name: check.lnk
>    check.lnk    Type: unspecified type (application/octet-stream)
>             Encoding: base64

sounds like the shorcut vulnerability posted to bugtraq a little over a month
ago:

  The Windows API that handles shortcut navigation is susceptible to
   buffer overflow attacks. The API, "SHGetPathFromIDList" will
   parse a shortcut file (.lnk) to find the target file, directory or URL. A
   specifically malformed link will cause any program using the API to
   follow that shortcut to crash.

   NOTE: While this vulnerability listing, as well as the exploit and the
   original USSR advisory only mention Serv-U FTP server, any
   Windows, Microsoft, or 3rd party program that uses the API could
   be vulnerable to this.

see bugtraq id 970 for more info

-mike