Microsoft emergency patch fails to fix critical ‘PrintNightmare’ vulnerability

[ad_1]

An emergency patch released by Microsoft on Tuesday failed to fully fix a critical vulnerability in all supported versions of Windows that allows attackers to take control of infected systems and run code of their choice, researchers said.

The threat, colloquially known as PrintNightmare, stems from errors in the Windows Print Spooler, which provides print functionality within local networks. The proof-of-concept exploit code was released publicly and then pulled, but not before others copied it. Researchers are tracking a vulnerability such as CVE-2021-34527.

a big deal

Attackers can exploit it remotely when printing capabilities are exposed to the Internet. Attackers can also use it to escalate system privileges once they use a different vulnerability to gain a grip within a vulnerable network. In either case, adversaries can then take control of the domain controller, which, as the server that authenticates local users, is one of the most security-sensitive assets on any Windows network.

Will Dorman, senior vulnerability analyst at CERT Coordination Center, a federally funded nonprofit project in the United States that investigates software bugs and works with companies and government to improve security. “Anytime there is a public exploit code for an unpatched vulnerability that could put a Windows domain controller at risk, that’s bad news.”

After the severity of the bug became apparent, Microsoft published an out-of-band fix on Tuesday. Microsoft said the update “fully addresses the general vulnerability.” But on Wednesday – just over 12 hours after the release – a researcher showed how exploits can bypass the patch.

“Dealing with strings and file names is tough,” Benjamin Delby, developer of the hacking tool, Mimikatz, and other software wrote on Twitter.

Accompanying Delpy’s tweet was a video that showed a hastily written exploit working against Windows Server 2019 that installed the out-of-band patch. The demo shows that the update failed to fix vulnerable systems that use certain settings for a feature called point and print, making it easier for network users to get the printer drivers they need.

Ads

The following is buried near the bottom of Microsoft’s guidance as of Tuesday: “Point and Print is not directly related to this vulnerability, but the technology weakens the local security situation in a way that makes the exploit possible.”

Tragedy of slips

Incomplete patch is the latest bug involving the PrintNightmare vulnerability. Last month, Microsoft’s monthly patch group fixed CVE-2021-1675, a print spooler bug that allowed hackers with limited system rights on a device to escalate the privilege to the administrator. Microsoft credited Zhipeng Huo of Tencent Security, Piotr Madej of Afine, and Yunhai Zhang of Nsfocus with discovering and reporting the flaw.

A few weeks later, two different researchers – Zhiniang Peng and Xuefeng Li of Sangfor – published an analysis of CVE-2021-1675 which showed that it can be exploited not only for privilege escalation, but also to achieve remote code execution. The researchers called their exploits PrintNightmare.

Ultimately, researchers determined that PrintNightmare exploited a similar (but ultimately different) vulnerability, CVE-2021-1675. Zhiniang Peng and Xuefeng Li removed their proof-of-concept exploit when they learned of the confusion, but by then, their exploit had already spread far and wide. There are currently at least three PoC exploits publicly available, some of which have capabilities far beyond what the initial exploit allowed.

Microsoft Repair protects Windows servers that are set up as domain controllers or Windows 10 devices that use default settings. Wednesday’s demo from Delpy shows that PrintNightmare works against a much wider range of systems, including those that have Point and Print enabled and select the NoWarningNoElevationOnInstall option. The researcher carried out the exploitation in mimicats.

Credentials will be required.

Besides trying to close the code execution vulnerability, Tuesday’s fix for CVE-2021-34527 also installs a new mechanism that allows Windows administrators to implement stronger restrictions when users try to install printer software.

“Prior to the installation of July 6, 2021 and newer Windows updates containing CVE-2021-34527 protection, the Printer Operators Security Group was able to install both signed and unsigned printer drivers on the printer server,” a Microsoft advisory said. “After installing these updates, delegated administration groups such as printer drivers can only install signed printer drivers. Administrator credentials will be required to install unsigned printer drivers on the printer server from now on.”

Although the out of scope patch released on Tuesday is incomplete, it still provides meaningful protection against the many types of attacks that exploit the print spooler vulnerability. So far, there are no known cases that researchers say put systems at risk. Unless that changes, Windows users should install both the June and Tuesday patch and wait for further instructions from Microsoft. Company representatives did not immediately have a comment for this post.

[ad_2]