PrintNightmare haunts Microsoft as patch may miss mark

Microsoft dropped an out-of-band patch to fix PrintNightmare, but there are concerns it may not be totally effective. This does not mean it shouldn’t be applied
Microsoft released a rare out-of-band patch on 7 July to fix the so-called PrintNightmare vulnerability, but appears to have failed to address some fundamental aspects of the Windows Print Spooler bug, meaning even fully patched systems may still be at risk, according to researchers.

The background to the somewhat confusing saga is thus: Microsoft had first patched CVE-2021-1675, as a relatively low-priority local privilege escalation vulnerability in June’s Patch Tuesday drop, but it came to prominence last week when two Chinese researchers, concerned that rivals were getting the jump on their research, released a proof of concept (PoC) exploit for what they believed was CVE-2021-1675. It was not; in fact, the researchers had exposed a far more dangerous RCE zero-day, CVE-2021-34527, for which no patch was available.

Almost immediately after the patch dropped, security pros said they had found that while the patch addressed the RCE component of PrintNightmare quite nicely, it failed to cover users against LPE in some specific situations – meaning an attacker already on the network could still wreak havoc if they wanted. In effect, the patch seems to be incomplete.

Huntress’s John Hammond said that to date, the firm had not seen a patch scenario that encompassed preventing LPE, preventing RCE, and most crucially for users, allowed them to print normally.

Moreover, the patch does not yet address various Microsoft systems, namely Windows 10 version 1607, Windows Server 2012 and Windows Server 2016. Microsoft said this was an intentional choice.

In a blog post, Redmond said: “Some packages are not quite ready for release. We feel that it is important to provide security updates as quickly as possible for systems we can confidently protect today.”

Regardless of the effectiveness of the patch, users are still best advised to download and apply it, even though this may be somewhat disruptive to security team schedules around the July Patch Tuesday drop, which will happen on 13 July.

Tenable staff research engineer Satnam Narang said PrintNightmare warranted immediate attention because of the ubiquity of Windows Print Spooler, and the prospect attackers could exploit the flaw to take over a domain controller.

“While we do not know with certainty why Microsoft chose to publish this as an out-of-band patch, we suspect the availability of a number of proof-of-concept exploit scripts along with reports of in-the-wild exploitation contributed to this decision,” he said. We expect it will only be a matter of time before it is more broadly incorporated into attacker toolkits.

“PrintNightmare will remain a valuable exploit for cyber criminals as long as there are unpatched systems out there, and as we know, unpatched vulnerabilities have a long shelf life for attackers.

“Now that Microsoft has released patches, organisations are strongly encouraged to apply the patches as soon as possible, especially as attackers incorporate readily available PoC exploit scripts into their toolkits,” Narang told Computer Weekly in emailed comments.

Tim Mackey, principal security strategist at the Synopsys CyRC (Cybersecurity Research Centre), agreed: “Whenever there is a new security disclosure, it should be assumed that knowledge of how to exploit the weaknesses in the disclosure is known.

“It should also be understood that once information is published online that it will be cloned or copied by someone else. PoCs of exploitable security issues are commonly posted after the security disclosure and associated patches are made public.

“Publication is a normal process because those details might allow other security researchers to identify other paths to exploitation that might also need patching. For users, the best thing they can do to avoid falling victim is to patch their Windows systems promptly,” he said.

Schreibe einen Kommentar

Deine E-Mail-Adresse wird nicht veröffentlicht. Erforderliche Felder sind mit * markiert

Diese Website verwendet künstliche Intelligenz und maschinelles Lernen, um Spam zu reduzieren. Erfahren Sie, wie Ihre Kommentardaten verarbeitet werden.

Ähnliche Beiträge


Der Aufstieg der unterirdischen Offline-Welt: Digitale Schmuggelnetzwerke

Erfahren Sie, wie digitale Schmugglernetzwerke weltweit einen unzensierten Zugang zur digitalen Welt in Gebieten ermöglichen, in denen Internetbeschränkungen und Zensur herrschen. Dieser Artikel beleuchtet das Phänomen des Offline-Internets und illustriert es anhand von Beispielen wie dem kubanischen „paquete semanal“ und dem Havanna Streit Network.


Dies verlängert die Lebensdauer Ihres Telefonakkus erheblich.

Wie lange nutzen Sie durchschnittlich ein Apple- oder Samsung-Smartphone? Häufig laufen die Verträge, die mit solchen Geräten einhergehen, zwei Jahre, danach haben Sie die Möglichkeit, einen neuen Vertrag mit Gerät abzuschließen. Das ist schade und alles andere als nachhaltig; das Gerät befindet sich nach zwei Jahren oft noch in gutem Zustand. Lediglich der Akku des Telefons wird in der Regel nach zwei Jahren an Qualität eingebüßt haben. Das bedeutet jedoch nicht, dass Sie das gesamte Gerät ersetzen müssen; allein der Austausch des Akkus Ihres Samsung-Telefons kann ausreichen, um weiterhin eine Weile nutzen zu können. Dies ist nicht nur nachhaltig, sondern auch kostengünstiger! Der Austausch des Akkus kann ab 30 Euro erfolgen, abhängig vom Samsung-Modell, das Sie besitzen.

  • Schlagwörter

  • Kategorien

  • Archive