Standard users can create these junction points on many default-configured systems, potentially preventing critical security updates from being installed system-wide. Security researcher Kevin Beaumont has discovered that this fix introduces a denial of service vulnerability that allows non-administrator users to block Windows security updates permanently. Beaumont found that through a simple command line operation, users can create a junction point (a type of file system redirection in Windows) that breaks the update mechanism. To mitigate this vulnerability, Microsoft implemented a fix that automatically creates a folder named “inetpub” on the system drive of all Windows systems, regardless of whether Internet Information Services (IIS) is installed. “After that point, the April 2025 Windows OS update (and future updates, unless Microsoft fix it) fail to ever install — they error out and/or roll back. Once this junction is established, Windows Update encounters errors when trying to interact with the folder, causing updates to fail or roll back. “Non-admin (and admin) users can create junction points in c:” Beaumont explained in his research. The flaw involved improper link resolution before file access (‘link following’) in the Windows Update Stack that allowed an authorized attacker to escalate privileges locally. Microsoft explicitly warned users not to delete this folder, as it’s an integral part of the security enhancement. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Security experts warn that this could be easily scripted and deployed by malware or malicious actors seeking to keep systems vulnerable to other exploits. Until Microsoft addresses this issue, system administrators are advised to monitor the system drive for unusual junction points. Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. This unintended consequence of the patch highlights the complexities of software security and the persistent challenge of preventing unforeseen vulnerabilities.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 25 Apr 2025 08:45:05 +0000