SMTP: .LNK

This signature detects e-mail attachments that have the extension .lnk and were sent through SMTP. Because .LNKs (Windows link) files can point to any program, this can indicate an incoming e-mail virus. Attackers can create a link pointing to a dangerous program, tricking users into executing the link and affecting the system.

Extended Description

Microsoft Windows is prone to a remote code execution vulnerability when handling a malicious shortcut (.lnk) file. An attacker can exploit this issue by crafting a malicious file and placing it on a Web site or sending it to a user through email followed by enticing them to open it and view the file's properties. This issue also poses a local threat as a local unprivileged attacker could exploit this issue without user interaction to gain elevated privileges. This vulnerability can facilitate arbitrary code execution with SYSTEM privileges. This BID is related to the issue described in BID 15069 (Microsoft Windows Malicious Shortcut Handling Remote Code Execution Vulnerability).

Affected Products

Avaya s8100_media_servers,Microsoft windows_xp_media_center_edition

References

BugTraq: 15070

CVE: CVE-2005-2118

URL: http://www.cknow.com/vtutor/FileExtensions.html http://www.novatone.net/mag/mailsec.htm http://support.microsoft.com/?kbid=235309

Short Name

SMTP:EXT:DOT-LNK

Severity

Minor

Recommended

False

Recommended Action

None

SMTP: .LNK

Extended Description

Affected Products

References

Found a potential security threat?