Microsoft warns about new vulnerability "PrintNightmare"

#5926783

Webhiker

2021-07-05 10:36

Assumption is the mother of all f-ups. Proven again and again. When will people learn.

#5926785

van_dammesque

2021-07-05 10:41

If you have a printer: Go to "Edit Group Policies", select "Computer Configuration", select "Administrative Templates", select "Printers", and disable the option "Allow the print job manager to accept client connections"

I am on Win 10, I only have "Allow Print Spooler to accept client connections" so have disabled that instead.

#5926810

Mineria

2021-07-05 12:36

van_dammesque:

I am on Win 10, I only have "Allow Print Spooler to accept client connections" so have disabled that instead.

You can disable publishing it as well

#5926830

Astyanax

2021-07-05 13:25

https://cdn.discordapp.com/attachments/247515315825672203/861568210569658398/unknown.png its disabled by default, unless you're sharing a wired printer amongst your local network. This exploit requires the installation of a compromised printer driver in the first place, it cannot be exploited simply by having client connections available. (or other trojan exploit) If your print domain is already infected, this exploit allows clients to be easily infected since the infected driver will be added to the print server store, clients could pull it down by clicking on or trying to print to it.

#5926837

asturur

2021-07-05 13:47

Webhiker:

Assumption is the mother of all f-ups. Proven again and again. When will people learn.

I think is more MS that should be speedier in fixin or disabling the policy with an update if they know the research came from an external lab

#5926842

David Lake

2021-07-05 14:14

Its "Print Spooler" on 7.

#5926860

schmidtbag

2021-07-05 15:57

How has MS not figured out yet that the reason their OS has always been plagued with security issues is because they keep opening up access to everything?

#5926879

dragonlord

2021-07-05 17:40

My understanding is that end users who have patched via WIndows Update in June are already protected/mitigated from this. The current issue is with businesses running Active Directory and so that will be patched soon. Meanwhile, there are mitigation workarounds to address this for business IT admins. Please correct me if I am wrong about this.

#5926881

tsunami231

2021-07-05 17:48

printer spool service? i have had that "manual" for decades i only turn it on when I actual need to print something, and I almost never do that. which manybe 3 times year? if that and i turn right off after doing so. I knew there was reason why I turn off printer spool

#5926882

kakiharaFRS

2021-07-05 17:48

another printer/spooler thing exploit wasn't that already a problem like 10 years ago (quick search found me 2010-2012-2013 already...) edit: thx tsunami completely forgot to do it when I installed my current pc from scratch

#5926885

Reddoguk

2021-07-05 18:06

I also have no use for printing services and have always disabled Printer Spool from way back as well as the other 2 printer services in Win10.

#5927087

Astyanax

2021-07-06 14:59

dragonlord:

My understanding is that end users who have patched via WIndows Update in June are already protected/mitigated from this.

they aren't, because of a still ongoing microsoft habbit of adding authenticated users to domain services.

#5927097

warezme

2021-07-06 15:41

Astyanax:

https://cdn.discordapp.com/attachments/247515315825672203/861568210569658398/unknown.png its disabled by default, unless you're sharing a wired printer amongst your local network. This exploit requires the installation of a compromised printer driver in the first place, it cannot be exploited simply by having client connections available. (or other trojan exploit) If your print domain is already infected, this exploit allows clients to be easily infected since the infected driver will be added to the print server store, clients could pull it down by clicking on or trying to print to it.

Thank you. I hate when a vulnerability is just blurted out without any background or explanation from the very basic. It should include the extent of the vulnerabilities including vectors along with solutions or work arounds.