Microsoft Confirms 'PrintNightmare' is New Windows Security Flaw

2 years ago 50

BOOK THIS SPACE FOR AD

ARTICLE AD

Microsoft late Thursday acknowledged a severe security vulnerability in the Print Spooler utility that ships by default on Windows and warned that the bug exposes users to computer takeover attacks.

Microsoft’s confirmation of a new, unpatched Windows Print Spooler bug comes days after researchers noticed that published proof-of-concept code for a different vulnerability was reliably exploiting fully patched Windows machines.

Microsoft’s own misdiagnosis of a Print Spooler flaw that was just patched in June this year also added to the confusion.

In a pre-patch advisory issued late Thursday, Microsoft said a reliable exploit could be launched remotely to take full control of unpatched machines.

[ SEE: Windows Admins Scrambling to Contain 'PrintNightmare' Flaw ]

“A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights,” according to Redmond's advisory.

“An attack must involve an authenticated user calling RpcAddPrinterDriverEx(),” the company added.

Microsoft made it clear this new vulnerability (CVE-2021-32527) is similar but distinct from the vulnerability the CVE-2021-1675 flaw that addressed a different vulnerability in RpcAddPrinterDriverEx().

“The attack vector is different as well. CVE-2021-1675 was addressed by the June 2021 security update,” the company said. “This is an evolving situation and we will update the CVE as more information is available.”

The U.S. government’s CISA cybersecurity agency is urging Windows fleet admins to disable the Windows Print spooler service in Domain Controllers and systems that do not print.

Print Spooler, which is turned on by default on Microsoft Windows, is an executable file that's responsible for managing all print jobs getting sent to the computer printer or print server.

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. Ryan is a journalist and cybersecurity strategist with more than 20 years experience covering IT security and technology trends. He is a regular speaker at cybersecurity conferences around the world. Ryan has built security engagement programs at major global brands, including Intel Corp., Bishop Fox and Kaspersky GReAT. He is a co-founder of Threatpost and the global SAS conference series. Ryan's career as a journalist includes bylines at major technology publications including Ziff Davis eWEEK, CBS Interactive's ZDNet, PCMag and PC World. Follow Ryan on Twitter @ryanaraine.

Previous Columns by Ryan Naraine:

Read Entire Article