PrintNightmare: Windows Zero-Day Accidentally Disclosed by Chinese Researchers
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-1675 | Remote Code Execution in Microsoft Windows Print Spooler (PrintNightmare) CVE-2021-1675 is a code execution flaw in the Windows Print Spooler service affecting the listed Windows 10, 7, 8.1, RT 8.1 and Windows Server editions. It is triggered through print operations processed by the spooler, notably print driver handling; the public PoC demonstrates DLL injection into the spooler, allowing an attacker to run arbitrary code with the privileges of the spooler service, typically SYSTEM. Successful exploitation yields full system compromise: installing programs, viewing or deleting data, creating accounts, and lateral movement into domains, which is why it has been widely used as a ransomware entry vector. Any Windows system with the Print Spooler service enabled is exposed, and the service runs by default on servers, domain controllers, and most workstations. Exploitation is confirmed in the wild: a public PoC is available, the flaw was weaponized by the Magniber and Vice Society ransomware groups, it was added to CISA KEV on 2021-11-03 with known ransomware use, and Microsoft issued out-of-band fixes after it was being exploited in the wild. Do: Apply Microsoft's out-of-band security updates immediately on all affected Windows client and server systems (per CISA KEV required action), prioritizing domain controllers and print/file servers. As an interim mitigation, disable the Print Spooler service on hosts that do not need printing (e.g., domain controllers) and restrict RPC/network access to the spooler on systems that must keep it running. Check for compromise by looking for unexpected DLL or driver files loaded by the spooler, spoolsv.exe spawning unusual child processes, and ransomware indicators given documented Magniber and Vice Society abuse. | 7.8 | 86% | KEV ransomware PoC |
| masshundreds of millions of Windows endpoints and servers (Print Spooler runs by default across the 1B+ device Windows installed base) |
Full article304 words · extracted from infosecurity-magazine.com · click to collapse
Security researchers in China have accidentally disclosed a critical Windows zero-day bug nicknamed “PrintNightmare.”
The proof-of-concept discovered by Shenzhen-based Sangfor Technologies was released this week after confusion over another Print Spooler vulnerability status.
In its June Patch Tuesday, Microsoft originally patched a high severity elevation of privilege vulnerability, CVE-2021-1675. However, last Monday it reclassified the bug as critical, after judging that it could enable remote code execution (RCE) without adding any more information.
Unfortunately, the researchers at Sangfor assumed that their RCE proof-of-concept affecting Windows Print Spooler was the same. Because CVE-2021-1675 had already been patched, they saw no harm in releasing details earlier than the intended date of Black Hat USA in August.
Now there’s a widely circulated zero-day in Print Spooler, with domain controller servers particularly at risk. Remote control of these could give ransomware actors and others access to enterprise networks.
Although authentication is needed first, this is an increasingly low bar for attackers, given the volume of breached credentials for RDP and other systems on the dark web.
Sophos principal research scientist, Paul Ducklin, said Microsoft could well release an out-of-band update to fix this before the July Patch Tuesday.
“Watch out for a patch and deploy it as soon as you can once it’s out. Until then, it looks as though disabling the Print Spooler on vulnerable computers is a satisfactory workaround,” he argued.
“If you have servers where you absolutely have to leave the Print Spooler running, we suggest that you limit network access to those servers as strictly as you can, even if it means that some of your users experience temporary inconvenience.”
Ducklin added that if there are servers where Print Spooler is not necessary, it should be turned off even after a patch is available in order to reduce the corporate attack surface.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/printnightmare-zero-day/