Friday, July 2nd 2021
Microsoft Acknowledges Severe, Unpatched, Actively Exploited Print Spooler Service Vulnerability "PrintNightmare"
Microsoft has acknowledged the existence of a severe and currently unpatched vulnerability in Windows' Print Spooler service (CVE-2021-34527). The vulnerability affects all versions of Windows, and is being actively exploited as per Microsoft. Poetically named "PrintNightmare", the vulnerability was published earlier this week as a PoC (Proof of Concept) exploit by security researchers, which believed the flaw had already been addressed by Microsoft at time of release (the company patched up another Print Spooler vulnerability issue with the June 2021 security patch). The code was made public and quickly scrapped when developers realized it gave would-be bad actors access to an unpatched way into users' systems - but since it's the Internet, the code had already been forked in GitHub.
The vulnerability isn't rated by the Windows developer as of yet, but it's one of the bad ones: it allows attackers to remotely execute code with system-level privileges. This is the ultimate level of security vulnerability that could exist. Microsoft is currently investigating the issue and developing a patch; however, given the urgency in closing down this exploit, the company is recommending disabling of the Windows Print Spooler service wherever possible, or at least disabling inbound remote printing through Group Policy. If you don't have a printer, just disable the service; if you do, please disable the Group Policy as per the steps outlined in the image below.
Sources:
Microsoft Vulnerability guide, via The Verge, Image courtesy of The Hacker News
The vulnerability isn't rated by the Windows developer as of yet, but it's one of the bad ones: it allows attackers to remotely execute code with system-level privileges. This is the ultimate level of security vulnerability that could exist. Microsoft is currently investigating the issue and developing a patch; however, given the urgency in closing down this exploit, the company is recommending disabling of the Windows Print Spooler service wherever possible, or at least disabling inbound remote printing through Group Policy. If you don't have a printer, just disable the service; if you do, please disable the Group Policy as per the steps outlined in the image below.
57 Comments on Microsoft Acknowledges Severe, Unpatched, Actively Exploited Print Spooler Service Vulnerability "PrintNightmare"
Also, how does the vulnerability actually work?
If you have group policy it's pretty easy to change that and in the op.
The worst part with Windows is that sometimes a print job will screw up so royally that you have to dive into hidden file folders and manually delete the bad print job. How is is that even Linux can do better than that?
If you are behind a NAT firewall that doesn't have the printer sharing ports opened/fowarded, then you are pretty safe from an internet based attack. But anyone that has access to your internal network could exploit this. And obviously if you say go connect your computer to a public WiFi, anyone else on that WiFi could possibly exploit this as well.
But it's still disabled now for me.
0patch.com/patches.html
/sNo it doesn't. Updates can be helpful but they are NOT the end-all-be-all solution to problems. Knowing how to isolate problems as they arise is more important. This is the main reason why firewalls were created. When you combine a competent firewall with competent app/program micromanagement software, you can effectively eliminate 99.9% of most of the problems that exist WITHOUT patching. This is why I stated very confidently earlier that XP and 7 can be secured and used safely on the internet. For those of us who know what we're doing, it is a relatively trivial effort.
System B *Cries in Windows* :banghead:
It's been about since pong but only now some researchers discovered it.