8 ms·

Windows Print Spooler Elevation of Privilege Vulnerability

124 points by danso 5y ago

high_byte 5y ago
is it wormable?
- ziml77 5y ago
  It's in the executive summary that it's not wormable on its own: > An attacker must have the ability to execute code on a victim system to exploit this vulnerability.
- deleted 5y ago
  [deleted]
- axiosgunnar 5y ago
  I have a question if I may, what is the difference between a worm and not being a worm?
  - londons_explore 5y ago
    wormable generally means that from one infected computer you can infect another computer with no human interaction. In general, not much is wormable across the internet anymore due to most devices being behind NAT. Within many companies, there are very few firewalls, so with a wormable exploit any attacker who is running malware on one computer would be able to infect most/all other computers.
  - Spooky23 5y ago
    Worms will often take down a large network from exponential growth. Upside is a non-wormable bug won’t do that, but you need to prevent and look for exploitation. This is tough as print is a dumpster fire in general, and who knows what’s lurking.
- Spooky23 5y ago
  No, but it’s pretty trivial to exploit in combination with other things.
  - gruez 5y ago
    What "other things" can it be combined with to get RCE?
    - deleted 5y ago
      [deleted]
    - smolder 5y ago
      Privilege escalation is what you do after you get unprivileged code execution, remote or otherwise, letting you then install an implant or something. If you want defense in depth, it's important to squash these issues, too, but they seem somewhat more common than RCEs.
nycdatasci 5y ago
Summary: An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. An attacker must have the ability to execute code on a victim system to exploit this vulnerability. The workaround for this vulnerability is stopping and disabling the Print Spooler service
xrayarx 5y ago
This is not the PrinterNightMare and not patched yet. Workaround is disable the Spooler.
- noxer 5y ago
  https://news.ycombinator.com/item?id=27865546 https://news.ycombinator.com/item?id=27865546
technion 5y ago
So as quick rundown: - Microsoft released June 8 update claiming to fix a printer security bug - A security researcher believes that was their previously reported printer bug, releases a write up and PoC. - Between June 9 and June 21, PrintNightmare was a known issue with no fix. - An unsupported ACL mitigation started doing the rounds on social media. People quickly found out it broke a lot of stuff, and there have been plenty of reddit posts about random things not working. I had to revert this mitigation just to get last week's Exchange update to aply - A June 21 out of band update came out claiming to fix the issue, but the situation was complicated enough that people started building flow charts trying to decide what is/isn't vulnerable[0] - Microsoft ships a July 13 update wherein this is finally properly patched, provided some registry keys are left at default - The documentation originally published incorrect registry keys, causing confusion about whether people were vulnerable - It's identified several printer vendors, and even the Samba team, have recommended the "bad" options that make this update not work - A new print spooler privesc comes out yesterday It's been an incredible mess for an organisation to stay on top of and now I've got vulnerability assessments telling me I should be disabling print spoolers when every user ever expects to be able to print. [0] https://twitter.com/StanHacked/status/1410922404252168196 https://twitter.com/StanHacked/status/1410922404252168196
- baybal2 5y ago
  Microsoft is known for bad security practices, and even worse practices when it comes to rectifying consequences of such. I bet with windows update being habitually turned off to prevent forced reboots, it will be a wave of exploiting when full details of the fix will be analysed. It's likely there are more Windows machines now which have autoupdate disabled because of forced reboots than the amount of machines with default settings. The decision to add forced reboot was one in line of many "shooting yourself in the foot" acts Microsoft did when it comes to software security.
  - shawnz 5y ago
    Let's say there was no auto-update, how would that solve the problem of encouraging manual updates?
deleted 5y ago
[deleted]
collsni 5y ago
Old news
- ThePowerOfFuet 5y ago
  Not old news. Brand new vulnerability, the third one in this series now.
  - noxer 5y ago
    Its the kind of vulnerability that would normal not get any attention. Its not a remote code vulnerability and has nothing to do with the recent remote code vulnerability other than the fact that it happens to be in the same part of the OS.
    - ThePowerOfFuet 5y ago
      Regardless, it's not old news.
      - noxer 5y ago
        Another user said that.
    - js4ever 5y ago
      Or maybe it's getting attention after thousands of successful ransomware attacks on Windows systems recently?
      - noxer 5y ago
        No, similar bugs are found and fixed all the time and no one cares. Also no plausible connections to the ransomware attacks. Which usually need a remote vuln. or targeted attack especially against people.
viraptor 5y ago
I don't normally go for memes, but this describes it pretty well. https://mobile.twitter.com/cyb3rops/status/1415937079645777921 https://mobile.twitter.com/cyb3rops/status/14159370796457779... There's a lot to discuss about those specific issues, but at the very core of it is: why is the printer spooler running as SYSTEM and why hasn't it been fixed a decade ago?
- Santosh83 5y ago
  I guess the thinking is if it ain't broken, don't fix it. Now that they've been majorly embarrassed, you can expect a re-architect of the print spooler for Windows 12.
  - smolder 5y ago
    ...And the insertion of new, obscure, poorly secured services related to emojis or something.
  - tonyedgecombe 5y ago
    >you can expect a re-architect of the print spooler for Windows 12. I don't envy the poor buggers tasked with that. The printing subsystem has been accumulating cruft for decades.
    - tinus_hn 5y ago
      They can just switch to AirPrint or something really similar and immensely simplify things while keeping 99% of the functionality people need.
      - tonyedgecombe 5y ago
        There is just so much stuff that that doesn't cover. Some companies have really complex printing requirements. There is a ton of legacy drivers, application software and printers that need supporting.
        5y ago
noxer 5y ago
"An attacker must have the ability to execute code on a victim system to exploit this vulnerability." Still a vulnerability but not comparable to the remote code one that was patched. Social media people telling everyone to disable the printer spooler should just stop. Its not recommended nor needed for private user.
jusssayin 5y ago
My Windows print spooler doesn't work at the best of times without repeated reboots and cycling the WIFI. If a vulnerability leads to correction of this poorly designed system it would be welcome.
maerek 5y ago
Apparently (from my colleagues) even the CIS Level 1 benchmark for Windows Server doesn’t actually recommend disabling the print spooler service by default, but that seems to be the common sense approach going forward. If you don’t need a software component, either uninstall it or disable it.
- oneplane 5y ago
  If you have a server that is an AD DC, you must at least run one with the print spooler if there is printing anywhere within AD, because that is the only way for AD to prune the spooler. So you might not need to print on your DC, but your DC needs the spooler so that you can keep your printing system, healthy everywhere else... it's pretty much an indirect requirement.
gjsman-1000 5y ago
For a $2 Trillion dollar company, the incompetence on display with this one is astounding. I wonder will if there will ever be a moment, a moment, where IT Admins revolt and tell the heads of corporate to rewrite their LOB applications as web apps and then deploy Chromebooks or Macs as clients because they can't stand nannying Windows anymore.
- TheRealDunkirk 5y ago
  If only money precluded incompetence. We probably have a functional government, for starters.
- pjmlp 5y ago
  Sure, if they have enough money to spare for the Macs, or like to use crippled computers while paying regular hardware prices, e.g. Chromebooks.
foysaluix 5y ago
I'm just few more exploits away from moving on to Linux.
- pjmlp 5y ago
  It won't save you. https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=linux https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=linux

124 points by danso 5y ago

high_byte 5y ago

is it wormable?

ziml77 5y ago
It's in the executive summary that it's not wormable on its own: > An attacker must have the ability to execute code on a victim system to exploit this vulnerability.
deleted 5y ago
[deleted]
axiosgunnar 5y ago
I have a question if I may, what is the difference between a worm and not being a worm?
- londons_explore 5y ago
  wormable generally means that from one infected computer you can infect another computer with no human interaction. In general, not much is wormable across the internet anymore due to most devices being behind NAT. Within many companies, there are very few firewalls, so with a wormable exploit any attacker who is running malware on one computer would be able to infect most/all other computers.
- Spooky23 5y ago
  Worms will often take down a large network from exponential growth. Upside is a non-wormable bug won’t do that, but you need to prevent and look for exploitation. This is tough as print is a dumpster fire in general, and who knows what’s lurking.
Spooky23 5y ago
No, but it’s pretty trivial to exploit in combination with other things.
- gruez 5y ago
  What "other things" can it be combined with to get RCE?
  - deleted 5y ago
    [deleted]
  - smolder 5y ago
    Privilege escalation is what you do after you get unprivileged code execution, remote or otherwise, letting you then install an implant or something. If you want defense in depth, it's important to squash these issues, too, but they seem somewhat more common than RCEs.

nycdatasci 5y ago

Summary: An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. An attacker must have the ability to execute code on a victim system to exploit this vulnerability. The workaround for this vulnerability is stopping and disabling the Print Spooler service

xrayarx 5y ago

This is not the PrinterNightMare and not patched yet. Workaround is disable the Spooler.

noxer 5y ago
https://news.ycombinator.com/item?id=27865546 https://news.ycombinator.com/item?id=27865546

technion 5y ago

So as quick rundown: - Microsoft released June 8 update claiming to fix a printer security bug - A security researcher believes that was their previously reported printer bug, releases a write up and PoC. - Between June 9 and June 21, PrintNightmare was a known issue with no fix. - An unsupported ACL mitigation started doing the rounds on social media. People quickly found out it broke a lot of stuff, and there have been plenty of reddit posts about random things not working. I had to revert this mitigation just to get last week's Exchange update to aply - A June 21 out of band update came out claiming to fix the issue, but the situation was complicated enough that people started building flow charts trying to decide what is/isn't vulnerable[0] - Microsoft ships a July 13 update wherein this is finally properly patched, provided some registry keys are left at default - The documentation originally published incorrect registry keys, causing confusion about whether people were vulnerable - It's identified several printer vendors, and even the Samba team, have recommended the "bad" options that make this update not work - A new print spooler privesc comes out yesterday It's been an incredible mess for an organisation to stay on top of and now I've got vulnerability assessments telling me I should be disabling print spoolers when every user ever expects to be able to print. [0] https://twitter.com/StanHacked/status/1410922404252168196 https://twitter.com/StanHacked/status/1410922404252168196

baybal2 5y ago
Microsoft is known for bad security practices, and even worse practices when it comes to rectifying consequences of such. I bet with windows update being habitually turned off to prevent forced reboots, it will be a wave of exploiting when full details of the fix will be analysed. It's likely there are more Windows machines now which have autoupdate disabled because of forced reboots than the amount of machines with default settings. The decision to add forced reboot was one in line of many "shooting yourself in the foot" acts Microsoft did when it comes to software security.
- shawnz 5y ago
  Let's say there was no auto-update, how would that solve the problem of encouraging manual updates?

deleted 5y ago

[deleted]

collsni 5y ago

Old news

ThePowerOfFuet 5y ago
Not old news. Brand new vulnerability, the third one in this series now.
- noxer 5y ago
  Its the kind of vulnerability that would normal not get any attention. Its not a remote code vulnerability and has nothing to do with the recent remote code vulnerability other than the fact that it happens to be in the same part of the OS.
  - ThePowerOfFuet 5y ago
    Regardless, it's not old news.
    - noxer 5y ago
      Another user said that.
  - js4ever 5y ago
    Or maybe it's getting attention after thousands of successful ransomware attacks on Windows systems recently?
    - noxer 5y ago
      No, similar bugs are found and fixed all the time and no one cares. Also no plausible connections to the ransomware attacks. Which usually need a remote vuln. or targeted attack especially against people.

viraptor 5y ago

I don't normally go for memes, but this describes it pretty well. https://mobile.twitter.com/cyb3rops/status/1415937079645777921 https://mobile.twitter.com/cyb3rops/status/14159370796457779... There's a lot to discuss about those specific issues, but at the very core of it is: why is the printer spooler running as SYSTEM and why hasn't it been fixed a decade ago?

Santosh83 5y ago
I guess the thinking is if it ain't broken, don't fix it. Now that they've been majorly embarrassed, you can expect a re-architect of the print spooler for Windows 12.
- smolder 5y ago
  ...And the insertion of new, obscure, poorly secured services related to emojis or something.
- tonyedgecombe 5y ago
  >you can expect a re-architect of the print spooler for Windows 12. I don't envy the poor buggers tasked with that. The printing subsystem has been accumulating cruft for decades.
  - tinus_hn 5y ago
    They can just switch to AirPrint or something really similar and immensely simplify things while keeping 99% of the functionality people need.
    - tonyedgecombe 5y ago
      There is just so much stuff that that doesn't cover. Some companies have really complex printing requirements. There is a ton of legacy drivers, application software and printers that need supporting.
      - 5y ago

noxer 5y ago

"An attacker must have the ability to execute code on a victim system to exploit this vulnerability." Still a vulnerability but not comparable to the remote code one that was patched. Social media people telling everyone to disable the printer spooler should just stop. Its not recommended nor needed for private user.

jusssayin 5y ago

My Windows print spooler doesn't work at the best of times without repeated reboots and cycling the WIFI. If a vulnerability leads to correction of this poorly designed system it would be welcome.

maerek 5y ago

Apparently (from my colleagues) even the CIS Level 1 benchmark for Windows Server doesn’t actually recommend disabling the print spooler service by default, but that seems to be the common sense approach going forward. If you don’t need a software component, either uninstall it or disable it.

oneplane 5y ago
If you have a server that is an AD DC, you must at least run one with the print spooler if there is printing anywhere within AD, because that is the only way for AD to prune the spooler. So you might not need to print on your DC, but your DC needs the spooler so that you can keep your printing system, healthy everywhere else... it's pretty much an indirect requirement.

gjsman-1000 5y ago

For a $2 Trillion dollar company, the incompetence on display with this one is astounding. I wonder will if there will ever be a moment, a moment, where IT Admins revolt and tell the heads of corporate to rewrite their LOB applications as web apps and then deploy Chromebooks or Macs as clients because they can't stand nannying Windows anymore.

TheRealDunkirk 5y ago
If only money precluded incompetence. We probably have a functional government, for starters.
pjmlp 5y ago
Sure, if they have enough money to spare for the Macs, or like to use crippled computers while paying regular hardware prices, e.g. Chromebooks.

foysaluix 5y ago

I'm just few more exploits away from moving on to Linux.

pjmlp 5y ago
It won't save you. https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=linux https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=linux