Attackers can turn a media (directory, drive, mail, ...) into a small attacking program allowing it to crash any application that would try to access it using SHELL32.DLL library (Explorer, IE, Outlook).
Credit:
The information has been provided by Aur?lien BOUDOUX and Fred CHAVEROT i2s-lab.com.
As a user browses through his hard-drive, Windows automatically analyses every file of the current directory, so as to allow the system to display the matching icon as well as file informations.
When Windows must analyse a shortcut (*.lnk), the system determines the properties of the file indicated by the link using its structure (see: The Windows Shortcut File Format).
Here is the structure of a windows link as we have understood it:
+-------------------------------------------------------------------+
| Shortcut HEADER |
+-------------------------------------------------------------------+
00000000 4C00 0000 L... 'L' Magic value
+-------------------------------------------------------------------+
| Item Id List |
+-------------------------------------------------------------------+
0000004C 4600 F. Size of item id list
+-------------------------------------------------------------------+
| First item |
+-------------------------------------------------------------------+
If we modify the name length at the offset 0x92, SHELL32.DLL will cause an access violation error, because text was about to be written outside of the the buffer allocated on the heap for this operation.
Exploit:
/****************************************
* TrapLink for SHELL32.DLL DoS Exploit *
****************************************
Discovered & coded by I2S-LaB
