Microsoft Alerts Users to Critical “PrintNightmare” Vulnerability Under Active Exploitation

On July 2, 2021, Microsoft confirmed that the “PrintNightmare” remote code execution (RCE) vulnerability in the Windows Print Spooler differs from a previously addressed issue in its recent Patch Tuesday update. The company has observed active attempts to exploit this flaw, tracked under CVE-2021-34527, with a severity rating of 8.8 on the CVSS scale. All Windows versions are affected by this vulnerability. Microsoft stated, “A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations.” Successful exploitation could allow attackers to execute arbitrary code with SYSTEM privileges, enabling them to install programs, manipulate data, or create accounts with full user rights.

Microsoft Alerts on Critical Vulnerability Exploited in the Wild

On July 2, 2021, Microsoft confirmed a severe vulnerability, dubbed “PrintNightmare,” affecting the Windows Print Spooler. Unlike a previous issue resolved in its Patch Tuesday update, this vulnerability is distinct and currently under active exploitation attempts. Microsoft has designated this flaw with the identifier CVE-2021-34527 and rated its severity at 8.8 on the Common Vulnerability Scoring System (CVSS).

The vulnerability exists in all versions of Windows, rendering them susceptible to exploitation. According to Microsoft’s advisory, the flaw arises when the Windows Print Spooler service improperly executes privileged file operations. Successful exploitation allows an attacker to execute arbitrary code with SYSTEM privileges, enabling them to install programs, view, modify, or delete data, and potentially create new user accounts with full rights.

Targeting the weakness is expected to affect a wide range of organizations, emphasizing the critical need for businesses to remain vigilant regarding their cybersecurity practices. Businesses utilizing any affected version of Windows are advised to implement immediate preventive measures to protect their systems from attacks that could follow this vulnerability.

While the specific origin of the attacks exploiting this vulnerability has yet to be disclosed, the risks extend globally, as organizations across various sectors leverage Windows operating systems. The precarious nature of the vulnerability significantly heightens the urgency for businesses to engage in proper threat management and patch implementation.

From a tactical perspective, the techniques relevant to this exploitation can be mapped to the MITRE ATT&CK framework, particularly encompassing initial access, privilege escalation, and execution tactics. Attackers may exploit the Print Spooler service as an entry point to leverage elevated privileges within an organization’s network. Understanding these tactics allows business owners to better strategize their defenses.

The PrintNightmare vulnerability serves as a stark reminder of the ever-present risks in cybersecurity. Staying informed and prepared to act is crucial for organizations to safeguard their sensitive information against such vulnerabilities. Business owners should prioritize regular software updates and implement robust security measures to mitigate the risk associated with this critical flaw.

Source link

Related Posts

Microsoft Releases Urgent Patch for Critical PrintNightmare Vulnerability in Windows

Microsoft has issued an emergency out-of-band security update to address a critical zero-day vulnerability, dubbed “PrintNightmare,” affecting the Windows Print Spooler service. This flaw, tracked as CVE-2021-34527 (with a CVSS score of 8.8), enables remote threat actors to execute arbitrary code and potentially seize control of affected systems. The issue impacts all supported versions of Windows, and the company recently reported active exploitation attempts targeting this vulnerability. According to the CERT Coordination Center, the Windows Print Spooler service does not adequately restrict access to functionalities that allow users to add printers and drivers, thus enabling a remote authenticated attacker to execute arbitrary code with SYSTEM privileges. Notably, PrintNightmare encompasses both remote code execution and local privilege escalation vectors that could be exploited in various attacks.

Microsoft’s Emergency Patch Ineffective Against PrintNightmare RCE Vulnerability

July 8, 2021

Microsoft’s attempt to mitigate the notorious PrintNightmare vulnerability across Windows 10 version 1607, Windows Server 2012, and Windows Server 2016 has proven inadequate. Reports indicate that the fix for the remote code execution exploit within the Windows Print Spooler service can still be circumvented under certain conditions, allowing attackers to execute arbitrary code on compromised systems. The company released an emergency out-of-band update for CVE-2021-34527 (CVSS score: 8.8) after researchers from Hong Kong-based cybersecurity firm Sangfor unintentionally disclosed the flaw late last month. Notably, this vulnerability is distinct from another issue, CVE-2021-1675, which Microsoft addressed on June 8. “Several days ago, two security vulnerabilities were identified in Microsoft Windows’ existing printing mechanism,” explained Yaniv Balmas, head of cyber research at C…

How to Address the Microsoft Print Spooler Vulnerability: Understanding PrintNightmare

Published on July 8, 2021

Recently, the PrintNightmare vulnerability in Microsoft’s Print Spooler (CVE-2021-34527) was escalated from ‘Low’ to ‘Critical’ severity. This change follows the release of a Proof of Concept on GitHub, which attackers might exploit to gain access to Domain Controllers. Although Microsoft issued a patch in June 2021, it fell short in preventing further exploits, as the Print Spooler feature remains accessible for remote connections. This article provides crucial insights into the vulnerability and offers guidance on mitigation strategies.

Overview of Print Spooler: The Print Spooler is a Microsoft service responsible for managing and monitoring print jobs. It is one of the oldest components in the Microsoft ecosystem and has seen minimal updates since its inception. By default, this service is enabled on all Microsoft devices, including servers and endpoints.

Understanding the PrintNightmare Vulnerability: Once an attacker achieves limited user access, they can exploit the Print Spooler to escalate privileges…

Critical Security Vulnerabilities Identified in Sage X3 Enterprise Management Software

Published: July 8, 2021

Recent research has revealed four significant security vulnerabilities in Sage X3’s enterprise resource planning (ERP) software. Two of these vulnerabilities can potentially be combined to facilitate an attack, allowing malicious actors to execute harmful commands and gain control over compromised systems. These issues were identified by researchers at Rapid7, who reported their findings to Sage Group on February 3, 2021. In response, the company has released patches for various versions of Sage X3, including Version 9 (Syracuse 9.22.7.2), Sage X3 HR & Payroll Version 9 (Syracuse 9.24.1.3), Version 11 (Syracuse 11.25.2.6), and Version 12 (Syracuse 12.10.2.8) in March. The identified vulnerabilities include:

  • CVE-2020-7388 (CVSS score: 10.0): Unauthenticated Remote Command Execution (RCE) as SYSTEM in the AdxDSrv.exe component.
  • CVE-2020-7389 (CVSS score: 5.5): System “CHAINE” Variable Script Command Injection (No fix planned).