Microsoft Fixes PrintNightmare Vulnerability, But Local Attack Remains Possible

General
Microsoft Fixes PrintNightmare Vulnerability, But Local Attack Remains Possible

Microsoft this week set out to fix a vulnerability known as "PrintNightmare," which, according to the Complete I.T. Blog, was first officially acknowledged by Microsoft on July 1. Microsoft's Windows Print Spooler service is running, the PC is open to attackers, who can remotely execute malicious code at will.

News of the fix for this vulnerability (filename CVE-2021-34527) came to our attention via @Msftsecresponse on Twitter: [Printers are a relatively common target for hackers trying to gain control of machines, Once they realize they have system privileges, they can easily perform countless sneaky acts such as shuffling data, deleting or copying important files, and even creating new accounts with administrative privileges.

The only workaround is for a system administrator to manually disable the Print Spooler service, which is useless if you need to use it on a daily basis.

However, since this patch is not a complete fix, Print Spooler users may be exposed to local attacks; as Tijs Hofmans of Tweakers points out, "It is still possible to perform privilege escalation locally. To prevent this, users can disable the Point&Print feature.

Security updates for Microsoft Windows Print Spooler can be found here anyway. Just beware of any suspicious-looking person, perhaps hooded, using your local network. That's what hackers look like.

Categories