Skip naar inhoud

PrintNightmare haunts Microsoft as patch may miss mark

Wilt u deze bijdrage aanbevelen? Dat kan via:

Share on facebook
Share on twitter
Share on linkedin
Share on reddit
Share on tumblr
Share on stumbleupon
Share on mix
Share on telegram
Share on pocket
Share on whatsapp
Share on email
Microsoft dropped an out-of-band patch to fix PrintNightmare, but there are concerns it may not be totally effective. This does not mean it shouldn’t be applied
Microsoft released a rare out-of-band patch on 7 July to fix the so-called PrintNightmare vulnerability, but appears to have failed to address some fundamental aspects of the Windows Print Spooler bug, meaning even fully patched systems may still be at risk, according to researchers.

The background to the somewhat confusing saga is thus: Microsoft had first patched CVE-2021-1675, as a relatively low-priority local privilege escalation vulnerability in June’s Patch Tuesday drop, but it came to prominence last week when two Chinese researchers, concerned that rivals were getting the jump on their research, released a proof of concept (PoC) exploit for what they believed was CVE-2021-1675. It was not; in fact, the researchers had exposed a far more dangerous RCE zero-day, CVE-2021-34527, for which no patch was available.

Almost immediately after the patch dropped, security pros said they had found that while the patch addressed the RCE component of PrintNightmare quite nicely, it failed to cover users against LPE in some specific situations – meaning an attacker already on the network could still wreak havoc if they wanted. In effect, the patch seems to be incomplete.

Huntress’s John Hammond said that to date, the firm had not seen a patch scenario that encompassed preventing LPE, preventing RCE, and most crucially for users, allowed them to print normally.

Moreover, the patch does not yet address various Microsoft systems, namely Windows 10 version 1607, Windows Server 2012 and Windows Server 2016. Microsoft said this was an intentional choice.

In a blog post, Redmond said: “Some packages are not quite ready for release. We feel that it is important to provide security updates as quickly as possible for systems we can confidently protect today.”

Regardless of the effectiveness of the patch, users are still best advised to download and apply it, even though this may be somewhat disruptive to security team schedules around the July Patch Tuesday drop, which will happen on 13 July.

Tenable staff research engineer Satnam Narang said PrintNightmare warranted immediate attention because of the ubiquity of Windows Print Spooler, and the prospect attackers could exploit the flaw to take over a domain controller.

“While we do not know with certainty why Microsoft chose to publish this as an out-of-band patch, we suspect the availability of a number of proof-of-concept exploit scripts along with reports of in-the-wild exploitation contributed to this decision,” he said. We expect it will only be a matter of time before it is more broadly incorporated into attacker toolkits.

“PrintNightmare will remain a valuable exploit for cyber criminals as long as there are unpatched systems out there, and as we know, unpatched vulnerabilities have a long shelf life for attackers.

“Now that Microsoft has released patches, organisations are strongly encouraged to apply the patches as soon as possible, especially as attackers incorporate readily available PoC exploit scripts into their toolkits,” Narang told Computer Weekly in emailed comments.

Tim Mackey, principal security strategist at the Synopsys CyRC (Cybersecurity Research Centre), agreed: “Whenever there is a new security disclosure, it should be assumed that knowledge of how to exploit the weaknesses in the disclosure is known.

“It should also be understood that once information is published online that it will be cloned or copied by someone else. PoCs of exploitable security issues are commonly posted after the security disclosure and associated patches are made public.

“Publication is a normal process because those details might allow other security researchers to identify other paths to exploitation that might also need patching. For users, the best thing they can do to avoid falling victim is to patch their Windows systems promptly,” he said.

Lees ook:

Speech2Text als basis voor ingesproken zorgrapportages

Bij overheidsinstellingen wordt automatische ondertitelingssoftware al veelvuldig ingezet voor de verslaglegging van raadsvergaderingen. Tijdens de vergadering wordt spraak direct omgezet naar tekst, waardoor de vergadering automatisch en direct ondertiteld wordt.

Germany and Austria implement repair bonuses

How do we make repair less expensive and therefore more attractive? In Austria and the German state of Thuringia, people can now be partially reimbursed when repairing a product thanks to a repair bonus.

China trekt teugels techbedrijven verder aan

China heeft haar greep op de technologiesector opnieuw verstevigd. Vanmorgen maakte de regering in Beijing een aantal maatregelen bekend die oneerlijke concurrentie moeten tegengaan. Ook het bewerken van persoonsgegevens en andere kritieke data wordt aan banden gelegd, evenals de toepassing van kunstmatige intelligentie en algoritmes.

Dataschrapers, wie doet ze wat?

Persoonsgegevens achterlaten op een sociaal platform is onderdeel van het spel, en iedereen kan goed inschatten waar het verstandig is dit wel te doen en waar vooral niet. Toch lagen kwamen onlangs miljoenen persoonsgegevens op straat te liggen. Niet via hacks, maar via scrapes.

OldFlix: We bewaren oude films en series en presenteren ze: In een Netflix-achtige methode, maar gratis!

Wie kent ze niet, Charlie Chaplin, Dallas Dolls, Philips met hun nieuwe spectaculaire uitvindingen tot de spannende avonturen van de jeugddetective Q & Q. Maar waar kijkt u ze? Vanaf

Wilt u deze bijdrage aanbevelen? Dat kan via:

Share on facebook
Share on twitter
Share on linkedin
Share on google
Share on reddit
Share on tumblr
Share on stumbleupon
Share on mix
Share on telegram
Share on pocket
Share on whatsapp
Share on email

Klaar voor de beste oplossing voor uw IT & ICT-situatie?

Ik heb mijn wachtwoord gewijzigd in “onjuist.” Dus wanneer ik vergeet wat het is, zal de computer zeggen: “Uw wachtwoord is onjuist.”