PrintNightmare haunts Microsoft as patch may miss mark

Microsoft dropped an out-of-band patch to fix PrintNightmare, but there are concerns it may not be totally effective. This does not mean it shouldn’t be applied
Microsoft released a rare out-of-band patch on 7 July to fix the so-called PrintNightmare vulnerability, but appears to have failed to address some fundamental aspects of the Windows Print Spooler bug, meaning even fully patched systems may still be at risk, according to researchers.

The background to the somewhat confusing saga is thus: Microsoft had first patched CVE-2021-1675, as a relatively low-priority local privilege escalation vulnerability in June’s Patch Tuesday drop, but it came to prominence last week when two Chinese researchers, concerned that rivals were getting the jump on their research, released a proof of concept (PoC) exploit for what they believed was CVE-2021-1675. It was not; in fact, the researchers had exposed a far more dangerous RCE zero-day, CVE-2021-34527, for which no patch was available.

Almost immediately after the patch dropped, security pros said they had found that while the patch addressed the RCE component of PrintNightmare quite nicely, it failed to cover users against LPE in some specific situations – meaning an attacker already on the network could still wreak havoc if they wanted. In effect, the patch seems to be incomplete.

Huntress’s John Hammond said that to date, the firm had not seen a patch scenario that encompassed preventing LPE, preventing RCE, and most crucially for users, allowed them to print normally.

Moreover, the patch does not yet address various Microsoft systems, namely Windows 10 version 1607, Windows Server 2012 and Windows Server 2016. Microsoft said this was an intentional choice.

In a blog post, Redmond said: “Some packages are not quite ready for release. We feel that it is important to provide security updates as quickly as possible for systems we can confidently protect today.”

Regardless of the effectiveness of the patch, users are still best advised to download and apply it, even though this may be somewhat disruptive to security team schedules around the July Patch Tuesday drop, which will happen on 13 July.

Tenable staff research engineer Satnam Narang said PrintNightmare warranted immediate attention because of the ubiquity of Windows Print Spooler, and the prospect attackers could exploit the flaw to take over a domain controller.

“While we do not know with certainty why Microsoft chose to publish this as an out-of-band patch, we suspect the availability of a number of proof-of-concept exploit scripts along with reports of in-the-wild exploitation contributed to this decision,” he said. We expect it will only be a matter of time before it is more broadly incorporated into attacker toolkits.

“PrintNightmare will remain a valuable exploit for cyber criminals as long as there are unpatched systems out there, and as we know, unpatched vulnerabilities have a long shelf life for attackers.

“Now that Microsoft has released patches, organisations are strongly encouraged to apply the patches as soon as possible, especially as attackers incorporate readily available PoC exploit scripts into their toolkits,” Narang told Computer Weekly in emailed comments.

Tim Mackey, principal security strategist at the Synopsys CyRC (Cybersecurity Research Centre), agreed: “Whenever there is a new security disclosure, it should be assumed that knowledge of how to exploit the weaknesses in the disclosure is known.

“It should also be understood that once information is published online that it will be cloned or copied by someone else. PoCs of exploitable security issues are commonly posted after the security disclosure and associated patches are made public.

“Publication is a normal process because those details might allow other security researchers to identify other paths to exploitation that might also need patching. For users, the best thing they can do to avoid falling victim is to patch their Windows systems promptly,” he said.

Geef een reactie

Het e-mailadres wordt niet gepubliceerd. Vereiste velden zijn gemarkeerd met *

Deze site gebruikt artificiële intelligentie en machine learning om spam te verminderen. Bekijk hoe uw reactiegegevens worden verwerkt.

Gerelateerde berichten

Achtergrond

De Opkomst van de Ondergrondse Offline Wereld: Digitale Smokkelnetwerken

Ontdek hoe digitale smokkelnetwerken over de hele wereld zorgen voor ongecensureerde toegang tot de digitale wereld in gebieden waar internetbeperkingen en censuur van kracht zijn. Dit artikel belicht het fenomeen van offline internet en illustreert het aan de hand van voorbeelden, zoals de Cubaanse “paquete semanal” en het Havana Street Network.

Lees verder
Gadgets

Op deze manier verlengt u aanzienlijk de levensduur van uw telefoonbatterij.

Hoe lang doet u gemiddeld met een Apple- of Samsung-smartphone? Vaak lopen de abonnementen die bij dergelijke toestellen horen twee jaar, waarna u de mogelijkheid heeft om een nieuw abonnement met toestel af te sluiten. Dat is zonde en allesbehalve duurzaam; het toestel verkeert na twee jaar vaak nog in goede staat. Slechts de accu van de telefoon zal na twee jaar doorgaans aan kwaliteit hebben ingeboet. Dit betekent niet dat u het toestel als geheel moet vervangen; enkel het vervangen van de batterij van uw Samsung-telefoon kan voldoende zijn om weer een tijd vooruit te kunnen. Niet alleen is dit duurzaam, maar het is ook voordeliger! Het vervangen van de batterij kan al vanaf 30 euro, afhankelijk van het model Samsung dat u heeft.

Lees verder
Blog

Het mysterie van de gouden pinnen: Waarom hebben kabels en connectoren zoveel contacten?

Heeft u ooit opgemerkt dat kabels en connectoren, zoals USB-sticks, HDMI-kabels en grafische kaarten, over een groot aantal gouden contacten beschikken? Maar waarom zijn er zoveel nodig? In deze blog duiken we dieper in op de redenen achter al deze contacten en leggen we uit waarom ze van cruciaal belang zijn voor elektronische apparaten. Lees verder om meer te ontdekken over de functies en betekenis van deze mysterieuze gouden pinnen.

Lees verder
  • Tags

  • Categorieën

  • Archieven