Microsoft's “PrintNightmare” patch doesn't fix issue, researchers say

Editor's Picks

Unearthing the bots: the importance of fraud detection in influencer marketing

Three keys to a productive tax time

Customer journeys and the transformative power of conversational AI

The state of Open Banking in the U.S.

Alleges the emergency patch still has holes.

A number of security researchers have cast doubts over Microsoft’s fix to address a vulnerability in Windows print spooler, also known as “PrintNightmare”.

First reported by Ars Technica and also covered by CRN sibling site iTnews, United States Computer Emergency Response Team vulnerability analyst Will Dormann and Mimikatz security tool developer Benjamin Delpy both took to Twitter to reveal the results of their patch testing.

Dormann expressed doubts on whether the patch was sufficient to prevent remote code execution and local privilege escalation to the SYSTEM Windows user.

Also, the @msftsecresponse description for how Point and Print is related seems to be just wrong. In my testing setting NoWarningNoElevationOnInstall = 0 does NOT prevent exploitation
Can we get some MSRC love to get the official publication as accurate as the Twitter volunteers? pic.twitter.com/rXaLU0P5tx

— Will Dormann (@wdormann) July 6, 2021

Delpy meanwhile said the patch may be bypassed by potential attackers if the Windows Point and Print technology is enabled.

Ho no… thanks to @bugch3ck idea about UNC path, KB5005010 “fix” about #printernightmare does not seems to block RCE (neither LPE) if Point&Print enabled …

Time to play with #mimikatz ���� https://t.co/8lEV7aG9AZ pic.twitter.com/wNt6lQF6Iy

— �� Benjamin Delpy (@gentilkiwi) July 7, 2021

Microsoft also advised affected users to disable Point and Print, a protocol that enables automatic downloads and installations of drivers for networked printers.

Dormann however pointed out that Microsoft did not actually explain how to disable Point and Print, and has questioned if the protocol can even be disabled at all.

Microsoft had a call for #PrintNightmare where they repeatedly said "Disable Point and Print"
without actually saying how one would do so.
I cannot find evidence that "Point and Print" itself is a thing that can be disabled.
MS seems to really want someone to hold their beer!
�� https://t.co/vFUdBnlESK

— Will Dormann (@wdormann) July 7, 2021

According to Microsoft, the vulnerability (officially dubbed “CVE-2021-34527”) is found in how print spooler improperly performs privileged file operations. An attacker could exploit it to install programs, change data and create new accounts with full user rights, among other actions.

iTnews reported last week that Hong Kong-based researchers Sangfor accidentally published the vulnerability in June, eventually deleting technical details and proof-of-concept code from Github.

All versions of Windows are vulnerable and domain controllers are affected if print spooler service is enabled. Updates were released for Windows Server 2019, Server 2016, Server 2012 and versions of Windows 7 and Windows 10.