Blank Inetpub folder

Topic

New Reply

The other day, Microsoft created the inetpub folder in the system drive as part of a mitigation protection for CVE-2025-21204. It applies to all versi
[See the full post at: Blank Inetpub folder]

Susan Bradley Patch Lady/Prudent patcher

4 users thanked author for this post.

jburk07, lmacri, John, PL1

Reply | Quote

Replies

https://www.askwoody.com/forums/topic/microsofts-patch-for-cve-2025-21204-introduces-another-vulnerability/

1 user thanked author for this post.

Fred

Reply | Quote

I haven’t tested this so can’t comment on its veracity. It seems the ‘additional’ vulnerability may be prevented if, as Born states at the end of the article:

“Addendum: I have tested it in a VM with Windows 10 22H2. If the April 2025 security update is installed and the inetpub folder is present, no junction can be created.”

https://borncity.com/win/2025/04/23/april-2025-patch-for-windows-symlink-vulnerability-cve-2025-21204-tears-new-security-issue/

Win10 Pro x64 22H2, Win10 Home 22H2, Linux Mint + a cat with 'tortitude'.

Reply | Quote

Brinkmann at ghacks reported on this as well. His comment:

“Note: The command given by Beaumont on the website seems wrong as mklink /j is used to create junction links that link to a directory and not a file. Unless I’m missing something, it needs to either do away with /j to create a symbolic link or /h to create a hard link. Whether that is also going to block Windows updates is unclear though.”

Junction vs symlink, directory vs file? Further clarification needed?

 

Win10 Pro x64 22H2, Win10 Home 22H2, Linux Mint + a cat with 'tortitude'.

3 users thanked author for this post.

abbodi86, Fred, Alex5723

Reply | Quote