The ongoing problem that is PrintNightmare just won’t end for Microsoft. The company has once again posted yet another security advisory in relation to the Windows Print Spooler service (via BleepingComputer.)
Assigned as CVE-2021-36958, this latest advisory sounds a bit familiar if you’re following this saga closely. That’s because, despite a recent security patch that requires administrator privileges for running Point and Print driver installations and updates, there’s still one glaring problem.
Someone with physical access to a PC can still gain system privileges if a set of rogue printer drivers (discovered last month by security researcher Benjamin Delp) for a network printer are already installed. Basically, you don’t need administrative privileges in cases where you need to connect to a printer or a print server when drivers are already installed. This will then allow the remote code to still be excuted as described by Microsoft:
A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
Microsoft is calling this a “remote code execution,” but this is actually a local one, with physical access being required. Microsoft credited FusionX, Accenture Security’s Victo Mata for this bug, and it’s likely that the advisory could be updated in a few days to “escalation of privilege,” according to Bleeping Computer.
Once again, there’s not yet a patch for this latest bug and Microsoft is working on a new fix. If you’re worried, you’ll have to disable the Print Spooler and prevent your device from printing. However, you can also change your settings so that your PC will only install printers from authorized servers. This can be done through the Group Policy Editor, as described by the security researcher Benjamin Delpy.
