Here’s a preliminary fix for the problem with LNK and PIF files (CVE-2010-2568).
I took the LinkIconShim from Libor Morkovsky and packaged it as an MSI for easier installation. For now you will still have to choose the right MSI, though, depending on what your system is.
Here are the downloads (via SSL), sizes and hashes:
- 32bit systems: LinkIconShim32.msi (63 KiB),
SHA1: ffb5fdf8c1c71c62539ddbb818a6395f76e5d2df - 64bit systems: LinkIconShim64.msi (111 KiB),
SHA1: 659896cd1411ed3371884f484f897824afcfa5bc
Update:
I’ve meanwhile created an even more convenient NSIS-based installer. The offered setup corresponds to rev 8 of the aforementioned project. It contains both the 32bit and the 64bit MSI files.
New download:
- lnkiconshim.exe (160 KiB),
SHA1: 1f89b3840dbff8efe41e0bb1855f564f7e6278f7
// Oliver
Disclaimer: This software is provided ‘as-is’, without any express or implied warranty. In no event will the author be held liable for any damages arising from the use of this software.
I don’t have a google code account, so I couldn’t add a comment
to LinkIconShim’s project page, but there’s a bug. He’s
adding the GUID, name pair backwards to the Approved Shell
extension list. (You can correct it by hand.)
The reason no one noticed if probably because by default,
the policy “Only allow approved shell extensions” is false,
so the white list is not enforced.