Public Windows PrintNightmare 0-day exploit allows domain takeover

[Thiagoo]

Microsoft's incomplete PrintNightmare patch fails to fix vulnerability​

Microsoft's incomplete PrintNightmare patch fails to fix vulnerability

Researchers have bypassed Microsoft's emergency patch for the PrintNightmare vulnerability to achieve remote code execution and local privilege escalation with the official fix installed.

www.bleepingcomputer.com

Even 0patch managed to fix it properly. What a shame

 

[The_King]

Windows security update KB5004945 breaks printing on Zebra printers​

Microsoft's recent out-of-band KB5004945 PrintNightmare security updates are preventing Windows users from printing to certain Zebra printers.

Last month, a PoC exploit for a new Windows Print Spooler remote code execution and local privilege escalation vulnerability called PrintNightmare was accidentally disclosed on GitHub.

Soon after, Microsoft acknowledged that it was actively exploited, and an unofficial 0Patch micropatch was released to temporarily fix the vulnerability.

This week, Microsoft released mandatory out-of-band Windows security updates to fix the remote code execution component of the PrintNightmare vulnerability.

• Windows 10, version 21H1 (KB5004945)
• Windows 10, version 20H1 (KB5004945)
• Windows 10, version 2004 (KB5004945)
• Windows 10, version 1909 (KB5004946)
• Windows 10, version 1809 and Windows Server 2019 (KB5004947)
• Windows 10, version 1607 and Windows Server 2016 (KB5004948)
• Windows 10, version 1507 (KB5004950)
• Windows Server 2012 (Monthly Rollup KB5004956 / Security only KB5004960)
• Windows 8.1 and Windows Server 2012 R2 (Monthly Rollup KB5004954 / Security only KB5004958)
• Windows 7 SP1 and Windows Server 2008 R2 SP1 (Monthly Rollup KB5004953 / Security only KB5004951)
• Windows Server 2008 SP2 (Monthly Rollup KB5004955 / Security only KB5004959)

However, researchers quickly determined that these patches did not fix the vulnerability in all cases.

Unfortunately, the patches are also causing printing issues for some Windows users.

Windows security update KB5004945 breaks printing on Zebra printers

Microsoft's recent out-of-band KB5004945 PrintNightmare security updates are preventing Windows users from printing to certain Zebra printers.

www.bleepingcomputer.com

 

[Gandalf_The_Grey]

Clarified Guidance for CVE-2021-34527 Windows Print Spooler Vulnerability:

Our investigation has shown that the OOB security update is working as designed and is effective against the known printer spooling exploits and other public reports collectively being referred to as PrintNightmare. All reports we have investigated have relied on the changing of default registry setting related to Point and Print to an insecure configuration.

/blog/2021/07/clarified-guidance-for-cve-2021-34527-windows-print-spooler-vulnerability/

 

[The_King]

Microsoft pushes emergency fix for Windows 10 KB5004945 printing issues​

Fixed using Known Issue Rollback feature​

Thursday night, Microsoft released an emergency fix for Windows 10 2004, Windows 10 20H2, and Windows 10 21H1 to resolve these issues.

"After installing KB5003690 or later updates (including out of band updates, KB5004760 and KB5004945), you might have issues printing to certain printers. Most affected printers are receipt or label printers that connect via USB," Microsoft stated in a new issue posted to the Windows 10 health dashboard.

This fix is being rolled out through Microsoft's Known Issue Rollback (KIR) feature, which distributes fixes for known issues through Windows Update and should reach most people within 24 hours.

While these fixes are distributed via Windows Update, they are not delivered as an actual update. Therefore, there is no easy way for Windows 10 users to know when a Known Issue Rollout fix is installed without checking the Registry.

To determine if this KIR is installed on your computer, you can open the Registry Editor and check if the following key exists. If it does, then the KIR has been installed on your computer.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FeatureManagement\Overrides\4\1861952651

If you do not see the KIR in the Registry, do not panic. It simply means it has not been pushed down to your computer yet.

Microsoft says the rollout is expected to be complete within 24 hours and that restarting the computer may speed up this process.

Microsoft pushes emergency fix for Windows 10 KB5004945 printing issues

Microsoft has released an emergency fix for printing issues affecting Zebra and Dymo receipt or label printers caused by changes in the recently released KB5003690, KB5004760, and KB5004945 updates.

www.bleepingcomputer.com

 

[upnorth]

 

[plat]

Windows print nightmare continues with malicious driver packages

Microsoft's print nightmare continues with another example of how a threat actor can achieve SYSTEM privileges by abusing malicious printer drivers.

www.bleepingcomputer.com

Source

 

[Gandalf_The_Grey]

Microsoft is sharing mitigation guidance on a new Windows Print Spooler vulnerability tracked as CVE-2021-34481 that was disclosed tonight.

Microsoft released an advisory Thursday night for a new CVE-2021-34481 elevation of privilege vulnerability in the Windows Print Spooler that Dragos security researcher Jacob Baines discovered.

Unlike the recently patched PrintNightmare vulnerability, this vulnerability can only be exploited locally to gain elevated privileges on a device.

"The attack is not really related to PrintNightmare. As you know, PN can be executed remotely and this is a local only vulnerability," Baines confirmed to BleepingComputer.

Not much is known at this time about the vulnerability, including what versions of Windows are vulnerable.

However, Baines did share with BleepingComputer that it is printer driver-related.

Baines will be sharing more information about CVE-2021-34481 on August 7th during a DEF CON talk titled "Bring Your Own Print Driver Vulnerability."

While Microsoft has not released security updates to address this flaw, they have provided mitigation measures that admins can use to block attackers from exploiting the vulnerability.

At this time, the available option is to disable the Print Spooler service on a vulnerable device.

Option 1 - Disable the Print Spooler service

If disabling the Print Spooler service is appropriate for your enterprise, use the following PowerShell commands:

Stop-Service -Name Spooler -Force

Set-Service -Name Spooler -StartupType Disabled

It is important to note that if you disable the print spooler on a device, the device will no longer print to a local or remote printer.

Microsoft shares guidance on new Windows Print Spooler vulnerability

Microsoft is sharing mitigation guidance on a new Windows Print Spooler vulnerability tracked as CVE-2021-34481 that was disclosed tonight.

www.bleepingcomputer.com

 

[ForgottenSeer 85179]

Windows Print Spooler Elevation of Privilege vulnerability (CVE-2021-1675) explained

I guess most of you heard about the Windows Print Spooler Elevation of Privilege vulnerability (CVE-2021-1675) in the last couple of weeks. It is a vulnerability that gives an attacker high privile…

thalpius.com

 

[Gandalf_The_Grey]

For me the most important part is:

this is a local only vulnerability

 

[blackice]

For me the most important part is:

And definitely blown out of proportion for home users. If I was corporate IT right now I would be very wary, though.

 

[silversurfer]

New Windows print spooler zero day exploitable via remote print servers​

Will Dormann, a vulnerability analyst for CERT/CC, has released an advisory for this vulnerability that provides further information.

"While Windows enforces that driver packages themselves are signed by a trusted source, Windows printer drivers can specify queue-specific files that are associated with the use of the device. For example, a shared printer can specify a CopyFiles directive for arbitrary ICM files," the new CERT advisory explains.

"These files, which are copied over with the digital-signature-enforced printer driver files are not covered by any signature requirement. That is, any file can be copied to a client system via Point and Print printer driver installation, where it can be used by another printer with SYSTEM privileges." "This allows for LPE on a vulnerable system."

What makes this vulnerability so dangerous is that it affects all current versions of Windows and allows a threat actor to gain limited access to a network and instantly achieve SYSTEM privileges on the vulnerable device. Using this access, threat actors can spread laterally through the network until they gain access to a domain controller.

A video demonstrating this attack was shared with BleepingComputer and displayed below.

New Windows print spooler zero day exploitable via remote print servers

Another zero day vulnerability in Windows Print Spooler can give a threat actor administrative privileges on a Windows machine through a remote server under the attacker's control and the 'Queue-Specific Files' feature.

www.bleepingcomputer.com

 

[silversurfer]

Mitja Kolsek, co-founder of the 0patch micropatching service, has released a free micropatch that can be used to fix all known PrintNightmare vulnerabilities.

"We therefore decided to implement the group policy-based workaround as a micropatch, blocking Point and Print printer driver installation from untrusted servers. This workaround employs Group Policy settings: the "Only use Package Point and Print" first requires every printer driver is in form of a signed package, while the "Package Point and print - Approved servers" limits the set of servers from which printer driver packages are allowed to be installed." Kolsek explains in a blog post.

New Windows PrintNightmare zero-days get free unofficial patch

A free unofficial patch has been released to protect Windows users from all new PrintNightmare zero-day vulnerabilities discovered since June.

www.bleepingcomputer.com

 

[CyberTech]

The saga for Microsoft's printer and related issues continues as earlier today the firm confirmed a new security flaw in the Windows Print Spooler service. The new vulnerability has been assigned the ID CVE-2021-36958 and here's how the Raedmond firm describes the new flaw:

A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

As may be noticeable for those who have been following the saga closely, the new issue is related to the ongoing PrintNightmare bug that the company released a patch for a couple of days earlier. Microsoft claimed the patch should be helpful in mitigating the problem to a large degree as it would now require administrator privileges for running Point and Print driver installations and updates. However, on systems that already have the printer driver installed, non-admin users who are possibly threat actors can still exploit the vulnerability.

The rest

Microsoft confirms there's yet another new Windows Print Spooler security bug

Microsoft has released today a new Print spooler service security vulnerability advisory under the ID CVE-2021-36958. As a temporary solution, the firm has asked users to disable the process.

www.neowin.net

 

[silversurfer]

Microsoft suggests once again to disable the Print Spooler to protect against new 0-day vulnerability​

This week, Microsoft disclosed yet another printing related vulnerability in Windows. The CVE reveals little information at this point as Microsoft's investigation is still ongoing.

According to the provided information, it is a remote code execution vulnerability that does affect the Windows Print Spooler.

A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Microsoft does not list the affected versions and editions of the company's Windows operating system, as research is still ongoing. All versions of Windows were affected by PrintNightmare, and it is possible that the new 0-day vulnerability affects all versions as well.

Microsoft notes that it is working on a security patch, which it will likely release as an out-of-band patch once produced.

Microsoft suggests once again to disable the Print Spooler to protect against new 0-day vulnerability - gHacks Tech News

Microsoft disclosed a new 0-day vulnerability of the Print Spooler of its Windows operating system this week; no patch is available, but a workaround has been provided.

www.ghacks.net

 

[Gandalf_The_Grey]

Windows 10 PrintNightmare has been handled irresponsibly by Microsoft, says security expert

Microsoft has had to battle a set of PrintNightmare vulnerabilities for months. If exploited, people can run programs with SYSTEM privileges, causing security issues. While Microsoft has issued patches and shared fixes, problems persist. I spoke with Benjamin Delpy, head of Research & Development Security Center at Banque de France, about the PrintNightmare vulnerabilities. Delpy has been on the forefront of discovering PrintNightmare vulnerabilities since they emerged and is often cited as the discoverer of issues related to Windows Print Spooler.

Before we dive into the ins and outs of PrintNightmare vulnerabilities, it's worth explaining what they are. There isn't a single PrintNightmare vulnerability. Instead, it's a "generic category of flaws in the Printing Spooler," Delpy says. "Basically, we use the term PrintNightmare now to describe vulnerability in the Windows Printing Spooler involving the installation of a driver and/or a printer."

Delpy explains that while Microsoft has worked to address the issue, that its efforts don't eliminate the source of vulnerabilities (emphasis added):
Microsoft introduced several fixes, but for now, none of them completely address all security problem regarding driver/printer installation for unprivileged users. Their fix now limits the default behavior of the spooler to NOT allow unprivileged users to install a driver (even legit one). They prefer to avoid the full problem, [rather] than to redesign some part of the product.

Security experts have joked about some of Microsoft's proposed solutions to PrintNightmare vulnerabilities. "Microsoft [is] a running gag by posting official workarounds like "Disable Printing Spooler," Delpy says.

The researcher explains that while PrintNightmare vulnerabilities aren't much of a threat for individual users, that they present a serious security risk for businesses.

"For individuals ... this is nearly nothing ... individuals are nearly every time administrator of their computer, and personal computer are nearly never reachable from the internet ... so [it's] not really a problem," Delpy explains.

The researcher continues, "This is a real problem for enterprises/organization/etc., because usually users are not admin (I hope ). With PrintNightmare vulnerabilities, when they run a program, macro, script, it can escalate privileges to SYSTEM and compromise the whole system. On some systems (shared desktop), it can even lead to capture credentials of other users/administrators to compromises other systems on the network. A 'Local Privilege Escalation' can often lead to "Remote Code E̶s̶c̶a̶l̶a̶t̶i̶o̶n̶ Execution."

Fixing the PrintNightmare vulnerabilities is complicated, in large part because it's a legacy component, explains Delpy:

"At this time, it's very difficult to fix all problems in a such legacy components. Protocols behinds it is documented for NT 3.1 ... On a security point of view, it must be completely rewritten to be fully isolated and to NOT have SYSTEM privilege ... it's a legacy of the past that must not exist anymore."

I asked Delpy if he thinks PrintNightmare will ever be completely fixed. His response was not optimistic:
It depends on so many things. To be honest, I think — if they invest some manpower — they can fix many problems around printer/driver installation. But at this time, they seem to prefer an attitude to prevent non-administrators [from taking] some basic action like they did before. [Which leaves] the responsibility to enterprise to bypass it or not ... it's not very responsible from Microsoft, but [lets them avoid having] to really fix deeper problems. If they choose to rewrite the spooler engine for a new one, yes, they can fix lots of actual (and future problems), but as you've seen, it's not a sexy topic for them.

Delpy warns that these types of vulnerabilities are often exploited in the wild. The cost of attacking someone through a discovered vulnerability is relatively low, and the process can be automated.

Windows 10 PrintNightmare has been handled irresponsibly by Microsoft, says security expert

The PrintNightmare saga has drawn out over several months, and a security expert says it may not be close to over.

www.windowscentral.com