Corsair H170i Elite Capellix XT review
Forspoken: PC performance graphics benchmarks
ASRock Z790 Taichi review
The Callisto Protocol: PC graphics benchmarks
G.Skill TridentZ 5 RGB 6800 MHz CL34 DDR5 review
Be Quiet! Dark Power 13 - 1000W PSU Review
Palit GeForce RTX 4080 GamingPRO OC review
Core i9 13900K DDR5 7200 MHz (+memory scaling) review
Seasonic Prime Titanium TX-1300 (1300W PSU) review
F1 2022: PC graphics performance benchmark review
Microsoft warns about new vulnerability "PrintNightmare"
In the Windows print queue (from Windows 7 on) is a vulnrebility to be found, Microsoft alerts users about the CVE-2021-34527 vulnerability called "PrintNightmare". it enables attackers to execute code on their machine remotely. This vulnerability can lead to a problem.
The vulnerability has been there for some years, but nothing was known until this week, when a Research Group released a kit on Github on how to exploit the weakness, assuming that it had been addressed earlier in June when Microsoft corrected another Windows Spool issue. The researchers believed that it was PrintNightmare, and because they thought it had been addressed before, they showed how to use it, but it turns out that it wasn't corrected and that millions of machines have now been exposed to severe safety problems.
Solving it
Since the vulnerability is present in multiple versions of Windows and has not yet been patched, Microsoft made certain recommendations to users to restrict access to the spooler service:
- If you don't have a printer: Disable the "Print queue" service.
- If you have a printer: Go to "Edit Group Policies", select "Computer Configuration", select "Administrative Templates", select "Printers", and disable the option "Allow the print job manager to accept client connections"
Microsoft looking at graphics machine learning development, potential DLSS equivalent? - 07/05/2021 09:04 AM
Microsoft is seeking a software developer in the segment of machine learning to enhance the computing power of graphics from current consoles....
Advertorial: Great Microsoft Windows 10 Pro Deal with URcdkey - 07/02/2021 08:10 AM
Nowadays, many users often continue to use unlicensed software. But this is a rather controversial way of saving. And now we are talking not so much about its illegality as about the danger of all k...
Microsoft removes application to verify Windows 11 requirements - relaxes requirements - 06/29/2021 04:51 PM
Earlier on, we reported a handy tool that verifies if your PC is compatible with the new Windows 11, which was short-lived as Microsoft removed it after several failures in the detection mechanism....
Microsoft Releases First Windows 11 Insider Preview Build - 06/29/2021 08:48 AM
Things are moving fast with Windows 11 now, two weeks ago we did not even know of its existence, today Microsoft released the first official Windows 11 Insider Preview. With this beta, developers and ...
Microsoft removes mandatory >1TB storage requirement for DirectStorage NVMe SSDs - 06/29/2021 08:37 AM
DirectStorage initially had a requirement of volume size, that value was 1TB, which now seems to have been changed. ...
Astyanax
Senior Member
Posts: 14978
Joined: 2018-03-21
Senior Member
Posts: 14978
Joined: 2018-03-21
#5927087 Posted on: 07/06/2021 02:59 PM
they aren't, because of a still ongoing microsoft habbit of adding authenticated users to domain services.
My understanding is that end users who have patched via WIndows Update in June are already protected/mitigated from this.
they aren't, because of a still ongoing microsoft habbit of adding authenticated users to domain services.
warezme
Senior Member
Posts: 235
Joined: 2007-05-26
Senior Member
Posts: 235
Joined: 2007-05-26
#5927097 Posted on: 07/06/2021 03:41 PM
its disabled by default, unless you're sharing a wired printer amongst your local network.
This exploit requires the installation of a compromised printer driver in the first place, it cannot be exploited simply by having client connections available. (or other trojan exploit)
If your print domain is already infected, this exploit allows clients to be easily infected since the infected driver will be added to the print server store, clients could pull it down by clicking on or trying to print to it.
Thank you. I hate when a vulnerability is just blurted out without any background or explanation from the very basic. It should include the extent of the vulnerabilities including vectors along with solutions or work arounds.
its disabled by default, unless you're sharing a wired printer amongst your local network.
This exploit requires the installation of a compromised printer driver in the first place, it cannot be exploited simply by having client connections available. (or other trojan exploit)
If your print domain is already infected, this exploit allows clients to be easily infected since the infected driver will be added to the print server store, clients could pull it down by clicking on or trying to print to it.
Thank you. I hate when a vulnerability is just blurted out without any background or explanation from the very basic. It should include the extent of the vulnerabilities including vectors along with solutions or work arounds.
Click here to post a comment for this news story on the message forum.
Senior Member
Posts: 2481
Joined: 2010-05-26
I also have no use for printing services and have always disabled Printer Spool from way back as well as the other 2 printer services in Win10.