PrintNightmare haunts Microsoft as patch may miss mark

Microsoft dropped an out-of-band patch to fix PrintNightmare, but there are concerns it may not be totally effective. This does not mean it shouldn’t be applied
Microsoft released a rare out-of-band patch on 7 July to fix the so-called PrintNightmare vulnerability, but appears to have failed to address some fundamental aspects of the Windows Print Spooler bug, meaning even fully patched systems may still be at risk, according to researchers.

The background to the somewhat confusing saga is thus: Microsoft had first patched CVE-2021-1675, as a relatively low-priority local privilege escalation vulnerability in June’s Patch Tuesday drop, but it came to prominence last week when two Chinese researchers, concerned that rivals were getting the jump on their research, released a proof of concept (PoC) exploit for what they believed was CVE-2021-1675. It was not; in fact, the researchers had exposed a far more dangerous RCE zero-day, CVE-2021-34527, for which no patch was available.

Almost immediately after the patch dropped, security pros said they had found that while the patch addressed the RCE component of PrintNightmare quite nicely, it failed to cover users against LPE in some specific situations – meaning an attacker already on the network could still wreak havoc if they wanted. In effect, the patch seems to be incomplete.

Huntress’s John Hammond said that to date, the firm had not seen a patch scenario that encompassed preventing LPE, preventing RCE, and most crucially for users, allowed them to print normally.

Moreover, the patch does not yet address various Microsoft systems, namely Windows 10 version 1607, Windows Server 2012 and Windows Server 2016. Microsoft said this was an intentional choice.

In a blog post, Redmond said: “Some packages are not quite ready for release. We feel that it is important to provide security updates as quickly as possible for systems we can confidently protect today.”

Regardless of the effectiveness of the patch, users are still best advised to download and apply it, even though this may be somewhat disruptive to security team schedules around the July Patch Tuesday drop, which will happen on 13 July.

Tenable staff research engineer Satnam Narang said PrintNightmare warranted immediate attention because of the ubiquity of Windows Print Spooler, and the prospect attackers could exploit the flaw to take over a domain controller.

“While we do not know with certainty why Microsoft chose to publish this as an out-of-band patch, we suspect the availability of a number of proof-of-concept exploit scripts along with reports of in-the-wild exploitation contributed to this decision,” he said. We expect it will only be a matter of time before it is more broadly incorporated into attacker toolkits.

“PrintNightmare will remain a valuable exploit for cyber criminals as long as there are unpatched systems out there, and as we know, unpatched vulnerabilities have a long shelf life for attackers.

“Now that Microsoft has released patches, organisations are strongly encouraged to apply the patches as soon as possible, especially as attackers incorporate readily available PoC exploit scripts into their toolkits,” Narang told Computer Weekly in emailed comments.

Tim Mackey, principal security strategist at the Synopsys CyRC (Cybersecurity Research Centre), agreed: “Whenever there is a new security disclosure, it should be assumed that knowledge of how to exploit the weaknesses in the disclosure is known.

“It should also be understood that once information is published online that it will be cloned or copied by someone else. PoCs of exploitable security issues are commonly posted after the security disclosure and associated patches are made public.

“Publication is a normal process because those details might allow other security researchers to identify other paths to exploitation that might also need patching. For users, the best thing they can do to avoid falling victim is to patch their Windows systems promptly,” he said.

Laisser un commentaire

Votre adresse e-mail ne sera pas publiée. Les champs obligatoires sont indiqués avec *

Ce site utilise l'intelligence artificielle et l'apprentissage automatique pour réduire les spams. Découvrez comment vos données de commentaire sont traitées.

Articles connexes


L'émergence du monde souterrain hors ligne : Réseaux de contrebande numérique

Découvrez comment les réseaux de contrebande numérique à travers le monde offrent un accès non censuré au monde numérique dans les zones avec lesquelles des restrictions Internet et une censure sont en place. Cet article met en évidence le phénomène d'Internet hors ligne et l'illustre à travers des exemples tels que le "paquete semanal" cubain et le réseau de rues de La Havane.

Lire la suite

Cela prolonge considérablement la durée de vie de votre batterie de téléphone.

Combien de temps utilisez-vous en moyenne un smartphone Apple ou Samsung ? Souvent, les contrats associés à ces appareils ont une durée de deux ans, après quoi vous avez la possibilité de souscrire un nouveau contrat avec un appareil. C'est dommage et tout sauf durable ; l'appareil est fréquemment encore en bon état après deux ans. Seule la batterie du téléphone aura généralement perdu en qualité après deux ans. Cela ne signifie pas que vous devez remplacer l'appareil dans son intégralité ; le remplacement de la batterie de votre téléphone Samsung peut être suffisant pour continuer à l'utiliser pendant un certain temps. Non seulement c'est durable, mais c'est aussi plus avantageux ! Le remplacement de la batterie peut commencer à partir de 30 euros, en fonction du modèle Samsung que vous possédez.

Lire la suite
  • Étiquettes

  • Catégories

  • Archives