CISA: Fix MFA and Patch Promptly to Stop Russian Attackers
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-34527 | PrintNightmare: Remote Code Execution in Microsoft Windows Print Spooler CVE-2021-34527, widely known as 'PrintNightmare', is a remote code execution flaw in the Microsoft Windows Print Spooler service, which improperly performs privileged file operations such as loading printer driver DLLs. An attacker with low-level access who can reach a machine's spooler, for example a domain user able to add a printer connection via Point and Print, can induce the SYSTEM-privileged service to load an attacker-controlled DLL with no user interaction required (CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N). Successful exploitation yields arbitrary code execution as SYSTEM, letting the attacker install programs, view, change or delete data, and create new accounts with full user rights, effectively achieving complete host compromise. The flaw affects all supported Windows client and server releases in the CISA data, Windows 10 from 1507 through 22H2, Windows 11, Windows RT 8.1, and Windows Server 2008, 2012 and 2016, wherever the Print Spooler service is running. Exploitation is confirmed in the wild: the bug was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use, the FBI and CISA have warned of Russian actors exploiting it, and EPSS places the 30-day exploitation probability at 99.8%. Do: Install the July 2021 security updates immediately, released July 6, 2021 with additional updates on July 7 for Windows Server 2012, Windows Server 2016 and Windows 10 version 1607, and review KB5005010 for restricting installation of new printer drivers after applying the July 6 updates. Where patching is delayed, disable the Print Spooler service on hosts that do not need printing or restrict Point and Print, and verify that NoWarningNoElevationOnInstall and UpdatePromptSettings under HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint are set to 0 or not defined (these keys do not exist by default, which is the secure state; NoWarningNoElevationOnInstall = 1 makes the system vulnerable by design). Prioritize domain controllers and servers with exposed spoolers, and hunt… | 8.8 | 100% | KEV ransomware PoC ×3 |
| masshundreds of millions of Windows systems (order of magnitude 10^8) |
Full article295 words · extracted from infosecurity-magazine.com · click to collapse
The US authorities have issued a new alert warning of Russian state-backed malicious activity involving exploiting a well-known bug in Windows Print Spooler discovered last year.
The US Cybersecurity and Infrastructure Security Agency (CISA) explained that Russian actors had been spotted exploiting the PrintNightmare bug (CVE-2021-34527) back in May 2021, targeting an unnamed NGO.
This was part of an attack chain that began when they exploited a misconfigured account set to default multi-factor authentication (MFA) protocols, allowing them to enroll a new device for MFA and access the victim’s network.
PrintNightmare then enabled the attackers to run arbitrary code with system privileges and subsequently access cloud and email accounts for document exfiltration.
The alert lists multiple mitigations that CISA urges all organizations to apply, including enforcing MFA and reviewing configuration policies to protect against “fail open” and re-enrollment scenarios.
It also asks organizations to make sure inactive accounts are disabled across Active Directory and MFA systems and that patches are prioritized for known exploited vulnerabilities.
“At CISA, we are great believers in MFA. It remains one of the most effective measures individuals and organizations can take to reduce their risk to malicious cyber activity. This advisory demonstrates the imperative that organizations configure MFA properly to maximize effectiveness,” said CISA director Jen Easterly.
“Now, more than ever, organizations must put their shields up to protect against cyber-intrusions, which means applying the mitigations in this advisory including enforcing MFA for all users without exception, patching known exploited vulnerabilities, and ensuring MFA is implemented securely.”
The PrintNightmare zero-day was first revealed accidentally by Chinese researchers in July 2021. It’s a remote code execution vulnerability that exists when the Windows Print Spooler service improperly performs privileged file operations, enabling attackers to run arbitrary with system privileges.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/cisa-fix-mfa-patch-promptly-stop/