What is PrintNightmare Vulnerability and how to get rid of it?
- Get link
- X
- Other Apps
What is PrintNightmare Vulnerability and how to get rid of it?
What is PrintNightmare?
PrintNightmare (CVE-2021-34527) vulnerability will allow the attackers with a regular user account to take over a Server, which the Windows Print Spooler Service is running. Windows Print Spooler Service runs from windows defaults on either Server and client PC including domain controllers on Active Directory environment. Print Spooler Service is an important Windows service used to manage print jobs sent to the printer or print server.
A team discovered this zero-day vulnerability and they published in a tweet regarding the fix for the vulnerability,
“We deleted the POC of PrintNightmare. To mitigate this vulnerability, please update Windows to the latest version, or disable the Spooler service. For more RCE and LPE in Spooler, stay tuned and wait our Blackhat talk.”
So as the tweet Windows already released their Security Patches for PrintNightmare vulnerability along with the latest Windows Updates.
PrintNightmare looks for the DLLs such as kernelbase.dll, unidrv.dll, and other DLLs which written inside subfolders of “C:Windows/System32/Spool/drivers”.
Windows Updates and Patches
You will get patches for PrintNightmare vulnerability if you check on Windows Updates you might receive with Mandatory Security Patches to be updated. These patches were released for Windows 10 from version 1809 to the latest and supported for Windows 7, 8.1, Windows Server 2008, 2012, and other versions. These patches were a fix for the PrintNightmare flaw in Print Spooler Service.
According to some Security Researchers, the above patch can be bypassed though as per Microsoft itself, these patches can be bypassed only for the users who modify system registry values.
Users are forced to disable “Print Spooler Service” on clients and servers which do not require any print services. However, if you cannot disable Print Spooler Service users are able to Disable inbound remote printing through Group Policy.
How to Disable Print Spooler service
Open Powershell and type the following commands to Disable the service
Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled
Disable inbound remote printing through Group Policy
- Open Run Command (Windows+R)
- Type “gpedit.msc” and Enter
From the Group Policy navigate to the following location
(Computer Configuration/Administrative Templates / Printers)
- Disable the “Allow Print Spooler to accept client connections”
This will block any inbound attacks through the Print Spooler service, so the system will not function as a print server but it will not interrupt local printing which directly connected to the PC.
- Get link
- X
- Other Apps
Comments
Post a Comment