|
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
This is me. This is me trying to figure out what best to do with a security issue in the news today. Or rather it’s what I’d like to be doing but I ca
[See the full post at: Print Nightmare is going to be a nightmare]
Susan Bradley Patch Lady/Prudent patcher
Susan Bradley Patch Lady/Prudent patcher
.. So for now if you run windows and print, take no action, other than to be your normal, careful, slightly paranoid self…
Take action and block WU from installing drivers.
Don’t use 3rd party “drivers update’ applications, use only OEM software..
All OS’s but domain controllers are the “keys to the kingdom” and thus the juicy target. They can gain control to the active directory domain if they target the domain controllers.
I’ve turned off the printspooler on my domain controllers but used the workaround (setting the permissions) on the print servers in the office. I didn’t do anything to the workstations at this time.
Susan Bradley Patch Lady/Prudent patcher
Title: Microsoft Security Update Revisions
Issued: July 1, 2021
************************************************************************************
Summary
=======
The following CVE has been published to the Security Update Guide.
======================================================================================
* CVE-2021-34527
– CVE-2021-34527 | Windows Print Spooler Remote Code Execution Vulnerability
– https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
– Version: 1.0
– Reason for Revision: Information published.
– Originally posted: July 1, 2021
– Updated: N/A
– Aggregate CVE Severity Rating: N/A
Executive Summary
Microsoft is aware of and investigating a remote code execution vulnerability that affects Windows Print Spooler and has assigned CVE-2021-34527 to this vulnerability. This is an evolving situation and we will update the CVE as more information is available.
A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
An attack must involve an authenticated user calling RpcAddPrinterDriverEx().
Please ensure that you have applied the security updates released on June 8, 2021, and see the FAQ and Workaround sections in this CVE for information on how to help protect your system from this vulnerability……
It’s not clear to me how a hacker can exploit this leak. I mean, what steps are needed to eventually gain control of the machine running the print spooler service?
From how I’ve read it:
1: Send an end user a document with a macro in it
2: Have the macro check for the logonserver
3: send a command to the DC’s print spooler with an “updated” print driver.
4: Use said new print driver to create a new admin account with desired credentials.
5: Do whatever you want with the network.
For local systems, basically do the same but you will only have access to the local system.
Forgot to mention, the code would have to be run first. So if a user gets a file with the exploit but doesn’t run it, there won’t be any issues. Just wanted to clarify this isn’t some magic code, it still requires user interaction unless the system has already been exploited previously in some way.
Noting:
Turns out this appears to be a new bug and not an unfixed vulnerability.
Nothing Earth-shattering to say here, but I’m always keen to point out that the lore (hype?) software makers push that “patched code is ALWAYS better than unpatched code” is not always right. It can’t be. The plain and simple fact is that a hastily-applied bugfix to cover up a security flaw in the design may in fact cause problems or even open up other security flaws. And almost certainly reduce functionality or performance. They even try to back this up by saying “Windows 10 is the most secure Windows ever”. LOL
Just think about it…
Something insanely complex that engineers designed then built and tested over months or years vs. something added-on in mere days after a flaw is reported…
Common sense tells those of us with long experience that “new and improved” is an entirely made-up marketing slogan, and is only rarely actually true.
Even the word “patch”…
Would you think a patched tire is better than a new tire? Would you be quick to take your car to have your tires patched in advance just in case you might run over a nail? The reality is that the tire might now be out of balance or compromised by having taken it off the rim.
I dislike that “security” is all too often used as a lever to herd people into spending money.
-Noel
0Patch : Free Micropatches for PrintNightmare Vulnerability (CVE-2021-34527)
Introduction
June 2021 Windows Updates brought a fix for a vulnerability CVE-2021-1675 originally titled “Windows Print Spooler Local Code Execution Vulnerability”. As usual, Microsoft’s advisory provided very little information about the vulnerability, and very few probably noticed that about two weeks later, the advisory was updated to change “Local Code Execution” to “Remote Code Execution”…It turned out that PrintNightmare was not, in fact, CVE-2021-1675 – and the published details and POC were for a yet unpatched vulnerability that turned out to allow remote code execution on all Windows Servers from version 2019 back to at least version 2008, especially if they were configured as domain controllers…Microsoft has confirmed it to be a separate vulnerability to CVE-2021-1675, assigned it CVE-2021-34527, and recommended that affected users either disable the Print Spooler service or disable inbound remote printing…
our team at 0patch has analyzed the vulnerability and created micropatches for different affected Windows versions, starting with those most critical:
Windows Server 2019 (updated with June 2021 Updates)
Windows Server 2016 (updated with June 2021 Updates)
Windows Server 2012 (updated with June 2021 Updates)
Windows Server 2008 R2 (updated with January 2020 Updates, no Extended Security Updates)Our micropatches prevent the APD_INSTALL_WARNED_DRIVER flag in dwFileCopyFlags of function AddPrinterDriverEx from bypassing the object access check, which allowed the attack to succeed. We believe that “install warned drivers” functionality is not a very often used one, and breaking it in exchange for securing Windows machines from trivial remote exploitation is a good trade-off.
Micropatches for PrintNightmare will be free until Microsoft has issued an official fix..
Well what do you know, that 0Patch subscription comes in handy even after moving off Windows 7. I only use my printer occasionally, though, so having to turn the spooler service on first and then shut it off again isn’t a great burden.
i7-10700k - ASROCK Z590 Pro4 - 1TB 970 EVO Plus M.2 - DDR4 3200 x 32GB - GeForce RTX 3060 Ti FTW - Windows 10 Pro
Yep, I also kept 0Patch even after I switched from W7 to W10.
Some more 0 Patch print spooler micro patches delivered on 5 July.
Because I don’t see active attacks on home users at this time, I recommend that you hold off installing this update. In fact, I’ll probably wait until the July updates come out next week before encouraging you to install any patches. Next week’s updates will include these fixes; there is no urgent need to install them right now.
Microsoft says Win 7 SP1 is affected.
We were so far unable to reproduce the problem on Windows 7. Microsoft may know something we don’t.
https://blog.0patch.com/2021/07/free-micropatches-for-printnightmare.html
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
