Announcement AMD Radeon RX 6600 XT
Arctic Liquid Freezer II 360 A-RGB review
Cooler Master Masterair MA624 Stealth/MA612 Stealth ARGB review
EVGA GeForce RTX 3080 Ti FTW3 Ultra Review
F1 2021: PC graphics performance benchmark review
Asustor Drivestor 4 Pro (AS3304T) NAS Review
Colorful iGame GeForce RTX 3090 KUDAN review
Corsair Virtuoso RGB Wireless XT headset review
Galax HOF OC Lab Water Cooling 4400 MHz CL19 review
Scythe Mugen 5 Black air cooler review
Microsoft warns about new vulnerability "PrintNightmare"
In the Windows print queue (from Windows 7 on) is a vulnrebility to be found, Microsoft alerts users about the CVE-2021-34527 vulnerability called "PrintNightmare". it enables attackers to execute code on their machine remotely. This vulnerability can lead to a problem.
The vulnerability has been there for some years, but nothing was known until this week, when a Research Group released a kit on Github on how to exploit the weakness, assuming that it had been addressed earlier in June when Microsoft corrected another Windows Spool issue. The researchers believed that it was PrintNightmare, and because they thought it had been addressed before, they showed how to use it, but it turns out that it wasn't corrected and that millions of machines have now been exposed to severe safety problems.
Solving it
Since the vulnerability is present in multiple versions of Windows and has not yet been patched, Microsoft made certain recommendations to users to restrict access to the spooler service:
- If you don't have a printer: Disable the "Print queue" service.
- If you have a printer: Go to "Edit Group Policies", select "Computer Configuration", select "Administrative Templates", select "Printers", and disable the option "Allow the print job manager to accept client connections"
Microsoft looking at graphics machine learning development, potential DLSS equivalent? - 07/05/2021 09:04 AM
Microsoft is seeking a software developer in the segment of machine learning to enhance the computing power of graphics from current consoles....
Advertorial: Great Microsoft Windows 10 Pro Deal with URcdkey - 07/02/2021 08:10 AM
Nowadays, many users often continue to use unlicensed software. But this is a rather controversial way of saving. And now we are talking not so much about its illegality as about the danger of all k...
Microsoft removes application to verify Windows 11 requirements - relaxes requirements - 06/29/2021 04:51 PM
Earlier on, we reported a handy tool that verifies if your PC is compatible with the new Windows 11, which was short-lived as Microsoft removed it after several failures in the detection mechanism....
Microsoft Releases First Windows 11 Insider Preview Build - 06/29/2021 08:48 AM
Things are moving fast with Windows 11 now, two weeks ago we did not even know of its existence, today Microsoft released the first official Windows 11 Insider Preview. With this beta, developers and ...
Microsoft removes mandatory >1TB storage requirement for DirectStorage NVMe SSDs - 06/29/2021 08:37 AM
DirectStorage initially had a requirement of volume size, that value was 1TB, which now seems to have been changed. ...
van_dammesque
Member
Posts: 32
Joined: 2004-11-18
Member
Posts: 32
Joined: 2004-11-18
#5926785 Posted on: 07/05/2021 10:41 AM
I am on Win 10, I only have "Allow Print Spooler to accept client connections" so have disabled that instead.
If you have a printer: Go to "Edit Group Policies", select "Computer Configuration", select "Administrative Templates", select "Printers", and disable the option "Allow the print job manager to accept client connections"
I am on Win 10, I only have "Allow Print Spooler to accept client connections" so have disabled that instead.
Mineria
Senior Member
Posts: 4533
Joined: 2007-05-05
Senior Member
Posts: 4533
Joined: 2007-05-05
#5926810 Posted on: 07/05/2021 12:36 PM
You can disable publishing it as well
I am on Win 10, I only have "Allow Print Spooler to accept client connections" so have disabled that instead.
You can disable publishing it as well
Astyanax
Senior Member
Posts: 10976
Joined: 2018-03-21
Senior Member
Posts: 10976
Joined: 2018-03-21
#5926830 Posted on: 07/05/2021 01:25 PM
its disabled by default, unless you're sharing a wired printer amongst your local network.
This exploit requires the installation of a compromised printer driver in the first place, it cannot be exploited simply by having client connections available. (or other trojan exploit)
If your print domain is already infected, this exploit allows clients to be easily infected since the infected driver will be added to the print server store, clients could pull it down by clicking on or trying to print to it.
its disabled by default, unless you're sharing a wired printer amongst your local network.
This exploit requires the installation of a compromised printer driver in the first place, it cannot be exploited simply by having client connections available. (or other trojan exploit)
If your print domain is already infected, this exploit allows clients to be easily infected since the infected driver will be added to the print server store, clients could pull it down by clicking on or trying to print to it.
asturur
Senior Member
Posts: 1114
Joined: 2010-05-12
Senior Member
Posts: 1114
Joined: 2010-05-12
#5926837 Posted on: 07/05/2021 01:47 PM
I think is more MS that should be speedier in fixin or disabling the policy with an update if they know the research came from an external lab
Assumption is the mother of all f-ups. Proven again and again. When will people learn.
I think is more MS that should be speedier in fixin or disabling the policy with an update if they know the research came from an external lab
Click here to post a comment for this news story on the message forum.
Senior Member
Posts: 732
Joined: 2011-03-23
Assumption is the mother of all f-ups. Proven again and again. When will people learn.