Microsoft have warned Windows users there is a critical flaw in the Windows Print Spooler service for which, as of 5th July 2021, there is no patch available.
*Please note this article was originally posted on 5th July 2021 and a patch has now been released.
PrintNightmare is what is known as an RCE and privilege escalation exploit. It allows a regular user to run arbitrary code on a remote system, whilst acting as a privileged account. In essence, it gives a user owner or admin rights over a system that they should not have access to.
This vulnerability, CVE-2021-34527 was initially discovered and disclosed to Microsoft several months ago. Microsoft claimed to have fixed and a patch was released as part of the June security patches. Unfortunately, a workaround was quickly found to this patch that allows the vulnerability to still be exploited, and proof-of-concept exploits started to appear publicly on the internet.
All current workstation and server versions of Windows are vulnerable to CVE-2021-34527. The only requirement is that the Print Spooler service is running.
Microsoft’s current recommendation is to turn off the Print Spooler, or otherwise disable the ability to print to a remote workstation or server. Unfortunately, this means that if you have printers which are shared from a server, these will no longer function.
Due to the relative difficulty of exploiting this vulnerability, and the need for an attacker to already have access to your network, we are currently not recommending any action be taken at this time.
Instead, we are monitoring the availability of patches and once available, we will be in touch to ensure these patches are installed.
If you have any questions regarding this, please contact our support team.
For more information, please read the Microsoft bulletin, which can be found here: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527