Replies

This Twitter thread warns that the OOB patch may not even fully fix the RCE:

https://twitter.com/gentilkiwi/status/1412706033072590852?s=20

Depressing.

Hi Susan,

Do you have a link for the Zebra side effects? We rely on Zebra label printers heavily at our company here. Thanks!

For what it’s worth, reports currently circulating on Twitter suggest that this patch only covers the RCE (“breaking in across the network”) part of the bug, not the EoP (“increasing account privilege after you’re in”) part…

From https://nakedsecurity.sophos.com/2021/07/07/printnightmare-official-patch-is-out-update-now/

I have not seen that on my test machines. Creating new folders works just as before on v2004.

Sophos said no, for whatever that’s worth.

I can corroborate. I built a new Win10 Pro v1903 VM earlier this week, using the current v1903 ISO, and experienced the Start menu critical error after KB4524147 was installed. (But not the printer spooler crash that I saw on other, newly upgraded to 1903 boxes.)

After applying KB4517389 and rebooting, the Start menu critical error persists. Hooray!

1 user thanked author for this post.

woody

My test machines get their updates from my corporate WSUS. While WSUS expired the original KB4093118 rollup and asked me to approve the new one, the test clients are NOT being offered the revised rollup. Not sure what this means (aside from the obvious failure of the rollup scheme to meet its goal of improved quality).

On my test machines, KB3203467 is installed. KB3203468 is not showing as available via WSUS. (In fact, WSUS says KB3203468 is already installed, which is not true.)

When I downloaded the KB3203468 (32-bit) update from Microsoft’s site, and tried to install it manually, it said it wasn’t applicable. Not sure why yet.

Got it.

Just to be clear, we are using the security-only ones. The detection failure is happening before any of today’s updates are installed. It’s not a case of me installing the KB4025341 monthly rollup by mistake and then wondering why IE11’s update isn’t needed.

(I don’t think you were saying that, but I wanted to be clear about what I was seeing.)

In our case, we’re using the “Security Only” versions of the Win7 cumulative updates.

Additionally, Security Update for Microsoft Office 2010 (KB3203468) 32-Bit Edition incorrectly shows as “installed.”

The other patches that would apply to my Win7 test systems are detecting correctly, though.

In my WSUS environment, today’s Cumulative Security Update for Internet Explorer 11 for Windows 7 for x64-based Systems (KB4025252) seems to have detection problems. On the WSUS status report for that update, it shows as “installed” for all systems that should get it. This is true on both of my WSUS servers, which are not replicas of each other.

Naturally, my systems do not have this update installed.

The 32-bit version of this update does not have this detection problem.

Anyone else seeing this?

1 user thanked author for this post.

NetDef

Hi Gary,

For the first 1-2 hours after the patches were released, my WSUS systems also experienced very slow downloads from the MS mothership. Looks like the speed has picked back up now, so I may actually get to install some patches on my test VMs later today.

I don’t have WD disabled via GPO, since I want something to be running before we install SEP on a new box. I just let SEP turn it off. Problem is, that means it’s too easy to fire up WD. (Don’t even need to be an admin, it seems.)

Might need to reconsider that now…

Using a test Win7 VM, I turned on WD for the first time in a long time.The About screen did not even show an “Engine Version” or an “Antispyware definitions” version. Not sure what that means regarding its status for this exploit.

Took nearly 20 minutes for it to update. It grabbed the update from our WSUS server.

I am considering temporarily activating WD across the enterprise long enough for this update to kick in. Doesn’t seem wise to leave the vulnerable engine in place, even if it is inactive.