Security researchers uncover more Print Spooler vulnerabilities

Microsoft advises customers to disable the component entirely to prevent attacks following the PrintNightmare debacle

Researchers have discovered two more vulnerabilities in the Print Spooler component that hackers can exploit to target vulnerable Windows systems, with Microsoft now urging customers to disable the service entirely. 

This third flaw to be discovered within a matter of weeks, tracked as CVE-2021-34481 and rated 7.8 on the CVSS threat severity scale, is an elevation of privilege vulnerability that could allow an attacker to run arbitrary code with system privileges. Attackers could then install programmes as well as view, change or delete data, and create new accounts with full user rights.

Its discovery prompted Microsoft to advise customers to disable the service entirely. This is only shortly after the firm made a second attempt to patch the PrintNightmare flaw, which was, in turn, targeted by hackers after security researchers inadvertently leaked instructions on how to exploit it

PrintNightmare, for reference, was the second flaw to be discovered in Print Spooler after a first remote code execution bug was patched in June.

The service manages print jobs sent remotely to a printer on the same network by storing data in a buffer and processing the jobs either in order of receipt or by priority.

The fourth bug, which hasn’t yet been acknowledged by Microsoft, centres on the fact that the point and print feature allows non-admin users to install printer drivers.

Related Resource

X-Force Threat Intelligence Index

Top security threats and recommendations for resilience

Transparent cube against a black background - whitepaper from IBMFree download

This is a tool that makes it easier for users within a network to obtain the printer drivers and queue documents to print.

According to CERT’s Will Dormann, printers installed through this method also install queue-specific files, which can be arbitrary libraries to be loaded by the privileged Print Spooler process. 

A flaw in the process means that local privilege escalation might be possible, with security researcher Benjamin Delpy demonstrating a proof-of-concept for successful exploitation of this fourth potential vulnerability. 

The point and print feature, which is at the centre of the fourth flaw, was also the reason why Microsoft’s first attempt to patch PrintNightmare wasn’t complete. Delpy also demonstrated that exploitation was still possible on a Windows Server 2019 deployment with point and print enabled.

Featured Resources

The ultimate law enforcement agency guide to going mobile

Best practices for implementing a mobile device program

Free download

The business value of Red Hat OpenShift

Platform cost savings, ROI, and the challenges and opportunities of Red Hat OpenShift

Free download

Managing security and risk across the IT supply chain: A practical approach

Best practices for IT supply chain security

Free download

Digital remote monitoring and dispatch services’ impact on edge computing and data centres

Seven trends redefining remote monitoring and field service dispatch service requirements

Free download

Recommended

AMD and Microsoft fix Ryzen performance in Windows 11
Hardware

AMD and Microsoft fix Ryzen performance in Windows 11

22 Oct 2021
What is Microsoft Edge? Everything you need to know
web browser

What is Microsoft Edge? Everything you need to know

22 Oct 2021
How to get help in Windows 10
operating systems

How to get help in Windows 10

22 Oct 2021
You can now test Android apps on Windows 11
Microsoft Windows

You can now test Android apps on Windows 11

21 Oct 2021

Most Popular

Best Linux distros 2021
operating systems

Best Linux distros 2021

11 Oct 2021
Apple MacBook Pro 15in vs Dell XPS 15: Clash of the titans
Laptops

Apple MacBook Pro 15in vs Dell XPS 15: Clash of the titans

11 Oct 2021
Windows 11 has problems with Oracle VirtualBox
Microsoft Windows

Windows 11 has problems with Oracle VirtualBox

5 Oct 2021