Microsoft’s Security Patch Made Windows Server and Client Systems Crash

essidsolutions

A security update rolled out by Microsoft earlier this month is causing systems running various versions of Windows Client and Windows Server to display the Blue Screen of Death. This occurs when users issue commands to certain printers from certain apps. Microsoft issued a patch this Monday to fix the vulnerability.

Microsoft recently took cognizance of an issue in the Windows operating system that caused a system to crash and display what is popularly known as the Blue Screen of Death. The global software giant said the issue was caused by a security update it rolled out earlier in March to patch a couple of privilege escalation vulnerabilities, assigned CVE-2021-1640Opens a new window and CVE-2021-26878Opens a new window , affecting Windows Print Spooler.

As it turns out, the fix itself was the source of the problem for users of both client and server versions of Windows 10. A Reddit post from an affected user and multiple reports referencing the subredditOpens a new window narrowed down the cause of the Blue Screen of Death to KB5000802, a security update released by Microsoft as part of March 2021 Patch Tuesday.

“After installing KB5000802, you might receive an APC_INDEX_MISMATCH error with a blue screen when attempting to print to certain printers in some apps,” Microsoft said. This includes Microsoft Office, Notepad, and others. The affected update is being automatically downloaded and installed across Windows 10 PCs and servers systems, indicating that the number of affected users could be in the millions.

Thankfully, mitigations are available, not through another patch from Redmond but via a few workarounds. The first is rolling back the update to the previous state, but this may expose users to the underlying security concern for which the update was released in the first place. Nevertheless, if users can afford to risk it, here’s how they can uninstall the security update:

Open Start > Settings > Update & Security > Windows Update > View Update History > Uninstall updates > spot the said update and Uninstall OR Start > Control Panel > Programs Programs and Features > View installed updates > uninstall Security Update for Microsoft Windows KB50000802. 

See Also: Microsoft Fixes Four Zero-Day Bugs in Exchange Servers Exploited by Chinese State-Sponsored Hackers

Users can also uninstall the affected update through command line instructions using the Windows Update Standalone Installer or wusa.exe. Additionally, users can also implement a couple of other workarounds laid out by a Microsoft employee.

Both methods, i.e., enabling direct printing from the Command Prompt or using the Compatibility Administrator tool, successfully mitigate the problem until Microsoft releases another software patch to fix the Blue Screen of Death issue permanently. The flaw introduced by the security update has reportedly affected printers from Kyocera, Ricoh, and Zebra.

“We are presently investigating and will provide an update when more information is available,” Microsoft said.  A permanent fix for the problem will probably be available on the next Patch Tuesday in April. Following are the Windows Client and Windows Server versions that were affected:

  • Windows Client: Windows 10, version 20H2; Windows 10, version 2004; Windows 10, version 1909; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803
  • Windows Server: Windows Server, version 20H2; Windows Server, version 2004; Windows Server, version 1909; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803

UPDATE: Instead of waiting until the next software patching schedule in April, Microsoft addressed the issue this Monday by issuing an update to fix the APC_INDEX_MISMATCH error that caused computers to crash upon receiving the print command. Users can get the update by going to Settings > Update & Security > Windows Update, and clicking Check for Updates.

Let us know if you liked this news on LinkedInOpens a new window , TwitterOpens a new window , or FacebookOpens a new window . We would love to hear from you!