Microsoft Pulls Bad Windows Update After Patch Tuesday Headaches (Ruh-roh!)

Microsoft released a new servicing stack update (KB5001078) after an older one caused problems for Windows users installing Patch Tuesday security updates.

Microsoft has removed a faulty servicing stack update, which was causing issues for Windows users when they tried to install last week’s Patch Tuesday security updates.

Microsoft’s servicing stack update provides fixes for the component that installs Windows updates. This particular defective update (KB4601392) applied to Windows 10 users (version 1607 for 32-bit and x64-based systems) and Windows Server 2016 users.

To address this issue, Microsoft has removed the faulty update and released a new one (KB5001078).

“There is a known issue that halts the installation progress of the February 9, 2021 security update,” said Microsoft on Friday.

Microsoft Faulty Update: A Windows Security Issue

Microsoft said that the erroneous servicing-stack update (KB4601392) froze installations for the “Cumulative Update” from the recent Windows Update. This resulted in the installation for the update halting at 24 percent.

Windows users – who reported issues – must install this new servicing stack update before installing the its recent February Patch Tuesday security update from last week.

“You must install the new servicing-stack update (SSU) KB5001078 before installing this cumulative update (LCU),” according to Microsoft. “SSUs improve the reliability of the update process to mitigate potential issues while installing the LCU and applying Microsoft security fixes.”

How Windows Users Can Mitigate if They Already Installed KB4601392

Microsoft gave the follow mitigation advice for devices that have already installed KB4601392:

Users should restart their devices and then follow only steps 1, 2 and 4a from Reset Windows Update components manually.
They should then restart their devices again.
KB5001078 should now install from Windows Update when users select “check for updates” – or they can wait for it to install automatically.
Users should then be able to install the latest Cumulative Update from Windows Update.

For Windows users who haven’t applied the previous update, the new update “is available through Windows Update,” said Microsoft. “It will be downloaded and installed automatically.”

To get the stand-alone package for the update, users can also go to the Microsoft Update Catalog website said Microsoft.

Patch Tuesday Security Updates: Apply Now

Microsoft’s February Patch Tuesday from last week addressed nine critical-severity cybersecurity bugs, plus an important-rated vulnerability that is being actively exploited in the wild.

The bug tracked as CVE-2021-1732, is being actively exploited, according to Microsoft’s advisory. This underscores the need for sysadmins to quickly apply the update. This is why the faulty servicing-stack update creating an obstacle for deploying Patch Tuesday updates is an issue for companies.

“The exploitation of this vulnerability would allow an attacker to execute code in the context of the kernel and gain SYSTEM privileges, essentially giving the attacker free rein to do whatever they wanted with the compromised machine,” said Chris Hass, director of Information Security and Research at Automox, in an email.

“Because this vulnerability is already being used by attackers, patching this vulnerability is as soon as possible is absolutely crucial,” said Hass.

> For any machines you personally use with Windows 10, do you utilize any temporary update blocking/delaying measures, and have they been helpful in heading off ~fixes of fixes~?

Excellent question.

I have two Win10 computers (VMs actually) -- one at work that is part of the company AD domain, and one at home for personal use.

The work VM, being tied to the AD domain, is under control of Corporate IT (of which I'm a member). We have an in-house WSUS server that proxies the updates, and we have a 3-stage process when updates are released. First, we test the updates on a couple "safe" crash-box machines that exist solely for that purpose. Second, we roll out the updates to a few selected "Early Adopter" employees who have bravely volunteered to be guinea pigs. Finally, we roll out the updates to the rest of the company, including my work VM. Problems at any of those stages cause an immediate stop to investigate the issue.

The personal VM at home is only used occasionally, so I generally keep it turned off unless I need to use it. As a result, I can wait until the work computers have been updated and things look good, before firing up the home VM and letting it update from the internet.

I'm just a simple laptop user. I'm always amazed at people who can handle the various computer systems. My oldest son is the tech genius in the family, but since he's been using PC's with Linux at home, and Windows on his work computer, I've learned to trouble-shoot any questions I might have with my Mac, because he doesn't know anything about them anymore. Thankfully, there have been very few problems on my Macs in all the years I've owned them.

The iMac I bought the end of 2010 still works, and I use it from time-to-time, but I mostly use my MacBook Pro which I bought about a year ago. My old MacBook Pro finally crapped the bed after 10 years, but at least the hard drive was salvageable.

In his spare time, my oldest son creates Fallout 4 mods, which he uploads to a website for people to download and use in the game. He has his own YouTube Channel that he uploads game videos to (Red Rocket TV). He also live streams on Twitch a few nights a week. He's 54, never took a computer class in his life, and taught himself everything he knows. He certainly didn't his brains from me.

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.