Read Time:1 Minute, 17 Second
Description
The software, when opening a file or directory, does not sufficiently handle when the file is a Windows shortcut (.LNK) whose target is outside of the intended control sphere. This could allow an attacker to cause the software to operate on unauthorized files.
The shortcut (file with the .lnk extension) can permit an attacker to read/write a file that they originally did not have permissions to access.
Modes of Introduction:
– Operation
Likelihood of Exploit: Low
Related Weaknesses
CWE-59
Consequences
Confidentiality, Integrity: Read Files or Directories, Modify Files or Directories
Potential Mitigations
Phase: Architecture and Design
Description:
CVE References
- CVE-2000-0342
- Mail client allows remote attackers to bypass the user warning for executable attachments such as .exe, .com, and .bat by using a .lnk file that refers to the attachment, aka “Stealth Attachment.”
- CVE-2001-1042
- FTP server allows remote attackers to read arbitrary files and directories by uploading a .lnk (link) file that points to the target file.
- CVE-2001-1043
- FTP server allows remote attackers to read arbitrary files and directories by uploading a .lnk (link) file that points to the target file.
- CVE-2005-0587
- Browser allows remote malicious web sites to overwrite arbitrary files by tricking the user into downloading a .LNK (link) file twice, which overwrites the file that was referenced in the first .LNK file.
- CVE-2003-1233
- Rootkits can bypass file access restrictions to Windows kernel directories using NtCreateSymbolicLinkObject function to create symbolic link
