August 2021 Patch Tuesday forecast: Dealing with emergency patching
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-34527 | PrintNightmare: Remote Code Execution in Microsoft Windows Print Spooler CVE-2021-34527, widely known as 'PrintNightmare', is a remote code execution flaw in the Microsoft Windows Print Spooler service, which improperly performs privileged file operations such as loading printer driver DLLs. An attacker with low-level access who can reach a machine's spooler, for example a domain user able to add a printer connection via Point and Print, can induce the SYSTEM-privileged service to load an attacker-controlled DLL with no user interaction required (CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N). Successful exploitation yields arbitrary code execution as SYSTEM, letting the attacker install programs, view, change or delete data, and create new accounts with full user rights, effectively achieving complete host compromise. The flaw affects all supported Windows client and server releases in the CISA data, Windows 10 from 1507 through 22H2, Windows 11, Windows RT 8.1, and Windows Server 2008, 2012 and 2016, wherever the Print Spooler service is running. Exploitation is confirmed in the wild: the bug was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use, the FBI and CISA have warned of Russian actors exploiting it, and EPSS places the 30-day exploitation probability at 99.8%. Do: Install the July 2021 security updates immediately, released July 6, 2021 with additional updates on July 7 for Windows Server 2012, Windows Server 2016 and Windows 10 version 1607, and review KB5005010 for restricting installation of new printer drivers after applying the July 6 updates. Where patching is delayed, disable the Print Spooler service on hosts that do not need printing or restrict Point and Print, and verify that NoWarningNoElevationOnInstall and UpdatePromptSettings under HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint are set to 0 or not defined (these keys do not exist by default, which is the secure state; NoWarningNoElevationOnInstall = 1 makes the system vulnerable by design). Prioritize domain controllers and servers with exposed spoolers, and hunt… | 8.8 | 100% | KEV ransomware PoC ×3 |
| masshundreds of millions of Windows systems (order of magnitude 10^8) |
Full article933 words · extracted from helpnetsecurity.com · click to collapse
The PrintNightmare print spooler vulnerability, CVE-2021-34527, caused a lot of excitement last month. If you’re still in an active patch cycle, ensure you install the latest cumulative (or monthly rollup) to address this vulnerability.
If you use Microsoft’s security only updates each month, be sure to include the security only out-of-band updates for your operating systems, because they must be installed for the PrintNightmare fix; they were not included in the Patch Tuesday set of security only updates. Extended Security Updates were provided for Windows 7 and Server 2008/2008 R2, but only if you purchased this service.
The release of zero-day updates, particularly one of this magnitude, provides an excellent opportunity to validate your emergency patching policies and procedures. If last month you were ‘running around with your hair on fire’ as the saying goes, now is the time to plan for the next issue because it is sure to come.
First, you must have a company policy in place which must be negotiated with and agreed upon by your security and legal teams. Some of the factors to consider include your company timeline to install the fixes throughout your network, a risk-based approach to protect the most critical systems, required coordination of activity, and so forth.
The first inclination of the security team is often to roll the updates out immediately, but that can often have a devastating impact on the overall business if the patches don’t perform as anticipated. You must have a trusted and validated process or procedure in place. From a best practices approach, many companies treat emergency patching as an accelerated version of the monthly patch cycle.
The updates are rolled out into a test environment consisting of systems configured to mirror the most critical or the most ‘patch sensitive’ to see how they perform. Once the known issues, if any, are identified you can roll the critical patch out to similar systems in your production environment.
In parallel or series depending upon your company’s capabilities, you repeat the process for a ‘phase 2’ set of less critical systems and so forth. While your normal monthly patch cycle may take 2 weeks of testing, you are usually only testing a single update here, so an accepted observation period may be just 2 days before the live rollout.
The important elements are that you know what to expect when the critical updates are installed, and you know how to respond if something doesn’t go as planned. Again, your company policy and procedure should support each other as the IT operations and security teams work together to secure your environment. There will always be exceptions but working from established procedures is much more comfortable than panicking when an emergency situation like the PrintNightmare vulnerability arises.
The July 2021 Patch Tuesday was an active one with 84 CVEs addressed in Windows 10 including 3 zero-days and 5 publicly disclosed vulnerabilities. I expect a smaller set of updates with fewer CVEs addressed this month as we are in the family vacation season and this year people are taking advantage of it.
One thing to make note of this month is Microsoft is going to enable an application control feature that will block potentially unwanted applications (PUAs). They quietly introduced this feature back in May and made this announcement concerning its enablement in the upcoming August updates. Just a ‘heads up’ in case you start to get calls from your users their personal applications are not working properly. The settings for this feature can be found in the Windows Security setting screen. Selecting Reputation-based protection settings under App & browser control, provides your configuration options.
Don’t forget, Windows 11 was officially announced on June 24. Although the announcement mentioned it would be released around the holidays, early indications are that it will come as early as October which is in line with the new versions of Windows 10 released in the past.
August 2021 Patch Tuesday forecast
- Nothing out of the ordinary on operating system and application support this month, although I predict the number CVEs addressed this month will drop well below last month. In addition to the regular supported operating systems, the Extended Security Updates (ESUs) for Windows 7 and Server 2008/2008 R2 will be released as usual. Internet Explorer updates are now a regular occurrence so expect another set this month.
- I don’t know what to say about a SQL server or .NET framework update any more. It’s been a while so be on the lookout just in case they show up.
- Adobe provided updates on July 20th for many of its applications and have not listed a pre-announcement for Acrobat and Reader. It should be a quiet week for them.
- Apple released security updates for the Big Sur, Mojave, and Catalina operating systems at the end of July so install those as soon as possible. We may see an iTunes or an iCloud security update sometime soon.
- Google released a stable channel update for Chrome OS to 92.0.4515.130 on August 2nd and several beta channel updates for other products this week so don’t expect a security release next week.
- Mozilla last provided security updates for Firefox and Thunderbird on July Patch Tuesday, so I think we will get a new set next week.
Take some time to do a retrospective on your handling of the PrintNightmare updates. Did your emergency patch procedures work as planned? Did you meet all your company’s security policy expectations? If not, now is the time to make some adjustments as needed. The next emergency patch situation could be just around the corner.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2021/08/06/august-2021-patch-tuesday-forecast/