Never before a simple folder had given so much to talk. We talk about “Inetpub”, an empty folder that appeared in storage C: millions of Windows 11 users after installing the last update; Its purpose remains a mystery, although Microsoft has warned that it is necessary.
Two weeks ago, Microsoft launched the KB5055523 update for Windows 11, as part of Patch Tuesday, the tradition of launching new patches and updates during the second Tuesday of each month. Unlike other recent updates, it did not include many novelties, and seemed to be a simple collection of patches and varied arrangements. Therefore, it was a surprise when the users met An empty folder, called “Inetpub” After updating.
After several days of confusion and conspiracy theories, Microsoft confirmed that His engineers had forgotten to include the creation of this folder as one of the changes introduced by the update; In addition, it warned users that they do not erase the folder, since although it is empty, it actually serves to mitigate a safety bug that allows the entry of an attacker into the system.
It is not clear exactly how the creation of a simple folder is able to block a hacker, but whatever, it seemed that this was the end of the story; But much less. As expected, this strange solution has caught the attention of cybersecurity experts, and one has already discovered a serious problem: The “Inetpub” folder can be used by hackers introducing another vulnerability in Windows.
The Security Researcher Kevin Beaumont He has shared information about this problem in his personal blog in Medium. Beaumont has discovered that the folder introduces a vulnerability of denial of service in Windows, which allows us to Users without administrator permits stop all updates system safety.
Indeed, with this ruling, an attacker could prevent our computer from being updated correctly, keeping the system in an old version; That can be tremendously useful from the point of view of a hacker, since it means that the team will not receive future bugs patches. The attacker only has to use a vulnerability that has been covered with a patch that has not been received by the victim’s computer.
The free android
The process to take advantage of this failure is really simple, because it only requires the creation of a symbolic direct access; Unlike other types of links in a folder, the symbolic link does not require special permits and any user can create them. A symbolic link created in this folder and aimed at an application (for example, notes) causes all updates to fail and not be installed correctly.
Beaumont states that contacted Microsoft two weeks ago to inform them of this problem, but that has not received an answer; Perhaps that is why, he has decided to make public the existence of this ‘bug’, hoping that Microsoft engineers realize their gravity.
