Description

The software, when opening a file or directory, does not sufficiently handle when the file is a Windows shortcut (.LNK) whose target is outside of the intended control sphere. This could allow an attacker to cause the software to operate on unauthorized files.

The shortcut (file with the .lnk extension) can permit an attacker to read/write a file that they originally did not have permissions to access.

Modes of Introduction:

– Operation

Likelihood of Exploit: Low

Related Weaknesses

CWE-59

Consequences

Confidentiality, Integrity: Read Files or Directories, Modify Files or Directories

Potential Mitigations

Phase: Architecture and Design

Description: 

CVE References

• CVE-2000-0342
  • Mail client allows remote attackers to bypass the user warning for executable attachments such as .exe, .com, and .bat by using a .lnk file that refers to the attachment, aka “Stealth Attachment.”

• CVE-2001-1042
  • FTP server allows remote attackers to read arbitrary files and directories by uploading a .lnk (link) file that points to the target file.

• CVE-2001-1043
  • FTP server allows remote attackers to read arbitrary files and directories by uploading a .lnk (link) file that points to the target file.

• CVE-2005-0587
  • Browser allows remote malicious web sites to overwrite arbitrary files by tricking the user into downloading a .LNK (link) file twice, which overwrites the file that was referenced in the first .LNK file.

• CVE-2001-1386
  • “.LNK.” – .LNK with trailing dot

• CVE-2003-1233
  • Rootkits can bypass file access restrictions to Windows kernel directories using NtCreateSymbolicLinkObject function to create symbolic link