Serious Windows Flaw: Hackers Can Remotely Crash PCs

Microsoft has described three Windows security fixes as an "essential" install even among users who normally take their time or pick and choose updates. It's one of 56 fixes in the latest monthly security update sometimes dubbed Patch Tuesday.

Two of the fixes are rated "Critical" and the other "Important". Those ratings are based on a combination of how likely the flaw is to be exploited and how serious the resulting damage could be.

Remote Code Execution Risk

The two critical fixes (codenamed CVE-2021-24074 and CVE-2021-24094) both create a risk of remote code execution. That's arguably the most serious security flaw as it effectively allows an attacker to remotely control the computer without needing a username or password to connect to the machine.

The closest thing to good news here is that Microsoft says these "vulnerabilities are complex which make it difficult to create functional exploits, so [attacks] are not likely in the short term." (Source: microsoft.com)

Blue Screen Of Death May Return

The important fix (CVE-2021-24086) is for a bug that could allow a denial of service. In this case, Microsoft isn't talking about the tactic by which attackers flood a website with bogus data requests to try to make it unavailable to legitimate visitors.

Instead in this scenario an attacker could exploit the bug to remotely crash a computer with a stop error, better known as the Blue Screen of Death. Microsoft says it expects attackers to figure out exploits "much more quickly" than with the critical bugs.

In all three cases, Microsoft flat out says that "It is essential that customers apply Windows updates to address these vulnerabilities as soon as possible." For most home users that will be covered by the automatic Windows Update but those who have it switched off should install the fixes manually. (Source: betanews.com)

As a sign of how seriously Microsoft is taking the issue, it's even devised (highly technically) workarounds for IT administrators who aren't able to update and restart systems straight away, such as those on complex systems or systems that can only have limited and controlled downtime.

What's Your Opinion?

Do you use automatic updates for security fixes? Do you understand and follow Microsoft's categorisation for different levels of risk from bugs? Could Microsoft do a better job of directly contacting users when the most serious security risks arise?