MSI MEG Z790 ACE review
Deepcool LT720 LCS Cooler Review
Arctic A35/I35 A-RGB air coolers review
Minisforum HX90G (Ryzen 9 5900HX + RX 6600M) mini PC review
MSI MPG Z790 Edge (DDR4) review
MSI GeForce RTX 4080 Gaming X TRIO review
Deepcool CH510 chassis review
Asus Delta S Wireless Headset review
GeForce RTX 4080 Founder edition review
MSI GeForce RTX 4080 Suprim X review
Microsoft warns about new vulnerability "PrintNightmare"
In the Windows print queue (from Windows 7 on) is a vulnrebility to be found, Microsoft alerts users about the CVE-2021-34527 vulnerability called "PrintNightmare". it enables attackers to execute code on their machine remotely. This vulnerability can lead to a problem.
The vulnerability has been there for some years, but nothing was known until this week, when a Research Group released a kit on Github on how to exploit the weakness, assuming that it had been addressed earlier in June when Microsoft corrected another Windows Spool issue. The researchers believed that it was PrintNightmare, and because they thought it had been addressed before, they showed how to use it, but it turns out that it wasn't corrected and that millions of machines have now been exposed to severe safety problems.
Solving it
Since the vulnerability is present in multiple versions of Windows and has not yet been patched, Microsoft made certain recommendations to users to restrict access to the spooler service:
- If you don't have a printer: Disable the "Print queue" service.
- If you have a printer: Go to "Edit Group Policies", select "Computer Configuration", select "Administrative Templates", select "Printers", and disable the option "Allow the print job manager to accept client connections"
Microsoft looking at graphics machine learning development, potential DLSS equivalent? - 07/05/2021 09:04 AM
Microsoft is seeking a software developer in the segment of machine learning to enhance the computing power of graphics from current consoles....
Advertorial: Great Microsoft Windows 10 Pro Deal with URcdkey - 07/02/2021 08:10 AM
Nowadays, many users often continue to use unlicensed software. But this is a rather controversial way of saving. And now we are talking not so much about its illegality as about the danger of all k...
Microsoft removes application to verify Windows 11 requirements - relaxes requirements - 06/29/2021 04:51 PM
Earlier on, we reported a handy tool that verifies if your PC is compatible with the new Windows 11, which was short-lived as Microsoft removed it after several failures in the detection mechanism....
Microsoft Releases First Windows 11 Insider Preview Build - 06/29/2021 08:48 AM
Things are moving fast with Windows 11 now, two weeks ago we did not even know of its existence, today Microsoft released the first official Windows 11 Insider Preview. With this beta, developers and ...
Microsoft removes mandatory >1TB storage requirement for DirectStorage NVMe SSDs - 06/29/2021 08:37 AM
DirectStorage initially had a requirement of volume size, that value was 1TB, which now seems to have been changed. ...
van_dammesque
Member
Posts: 42
Joined: 2004-11-18
Member
Posts: 42
Joined: 2004-11-18
#5926785 Posted on: 07/05/2021 10:41 AM
I am on Win 10, I only have "Allow Print Spooler to accept client connections" so have disabled that instead.
If you have a printer: Go to "Edit Group Policies", select "Computer Configuration", select "Administrative Templates", select "Printers", and disable the option "Allow the print job manager to accept client connections"
I am on Win 10, I only have "Allow Print Spooler to accept client connections" so have disabled that instead.
Mineria
Senior Member
Posts: 5505
Joined: 2007-05-05
Senior Member
Posts: 5505
Joined: 2007-05-05
#5926810 Posted on: 07/05/2021 12:36 PM
You can disable publishing it as well
I am on Win 10, I only have "Allow Print Spooler to accept client connections" so have disabled that instead.
You can disable publishing it as well
Astyanax
Senior Member
Posts: 14439
Joined: 2018-03-21
Senior Member
Posts: 14439
Joined: 2018-03-21
#5926830 Posted on: 07/05/2021 01:25 PM
its disabled by default, unless you're sharing a wired printer amongst your local network.
This exploit requires the installation of a compromised printer driver in the first place, it cannot be exploited simply by having client connections available. (or other trojan exploit)
If your print domain is already infected, this exploit allows clients to be easily infected since the infected driver will be added to the print server store, clients could pull it down by clicking on or trying to print to it.
its disabled by default, unless you're sharing a wired printer amongst your local network.
This exploit requires the installation of a compromised printer driver in the first place, it cannot be exploited simply by having client connections available. (or other trojan exploit)
If your print domain is already infected, this exploit allows clients to be easily infected since the infected driver will be added to the print server store, clients could pull it down by clicking on or trying to print to it.
asturur
Senior Member
Posts: 1277
Joined: 2010-05-12
Senior Member
Posts: 1277
Joined: 2010-05-12
#5926837 Posted on: 07/05/2021 01:47 PM
I think is more MS that should be speedier in fixin or disabling the policy with an update if they know the research came from an external lab
Assumption is the mother of all f-ups. Proven again and again. When will people learn.
I think is more MS that should be speedier in fixin or disabling the policy with an update if they know the research came from an external lab
Click here to post a comment for this news story on the message forum.
Senior Member
Posts: 742
Joined: 2011-03-23
Assumption is the mother of all f-ups. Proven again and again. When will people learn.