Microsoft has removed a faulty servicing update, which was causing issues for Windows users when they tried to install last week’s Patch Tuesday security updates.
Microsoft released a new servicing stack update (KB5001078) after an older one caused problems for Windows users installing Patch Tues. security updates.
Defective Update
Microsoft’s servicing stack update provides fixes for the component that installs Windows updates. This particular defective update (KB4601392) applied to Windows 10 users (version 1607 for 32-bit & x64-based systems) & Windows Server 2016 users.
To address this issue, Microsoft has removed the faulty update & released a new one (KB5001078).
“There is a known issue that halts the installation progress of the Feb. 9, 2021 security update,” commented Microsoft on Fri.
Windows Security Issue
Microsoft explained that the erroneous servicing-stack update (KB4601392) froze installations for the “Cumulative Update” from the recent Windows Update. This resulted in the installation for the update halting at 24%.
Windows users – who reported issues – must install this new servicing stack update before installing its recent Feb. Patch Tues. security update from last week.
“You must install the new servicing-stack update (SSU) KB5001078 before installing this cumulative update (LCU),” according to Microsoft. “SSUs improve the reliability of the update process to mitigate potential issues while installing the LCU & applying Microsoft security fixes.”
If KB4601392 Already Installed
Microsoft gave the follow mitigation advice for devices that have already installed KB4601392:
- Users should restart their devices & then follow only steps 1, 2 and 4a from Reset Windows Update components manually.
- They should then restart their devices again.
- KB5001078 should now install from Windows Update when users select “check for updates” – or they can wait for it to install automatically.
- Users should then be able to install the latest Cumulative Update from Windows Update.
For Windows users who have not applied the previous update, the new update “is available through Windows Update,” said Microsoft. “It will be downloaded & installed automatically.”
To get the stand-alone package for the update, users can also go to the Microsoft Update Catalog website stated Microsoft.
Patch Tuesday
Microsoft’s Feb. Patch Tues. from last week addressed 9 critical-severity cyber-security bugs, plus an important-rated vulnerability that is being actively exploited in the wild.
The bug tracked as CVE-2021-1732, is being actively exploited, according to Microsoft’s advisory. This underlines the need for sysadmins to quickly apply the update. This is why the faulty servicing-stack update creating an obstacle for deploying Patch Tues. updates is an issue for companies.
Execute Code
“The exploitation of this vulnerability would allow an attacker to execute code in the context of the kernel & gain SYSTEM privileges, essentially giving the attacker free rein to do whatever they wanted with the compromised machine,” outlined Chris Hass, Director of Information Security & Research at Automox.
“Because this vulnerability is already being used by attackers, patching this vulnerability is as soon as possible is absolutely crucial,” said Hass.
https://www.cybernewsgroup.co.uk/virtual-conference-march-2021/
