{"id":79,"date":"2021-07-01T09:50:51","date_gmt":"2021-07-01T09:50:51","guid":{"rendered":"https:\/\/www.geekmungus.co.uk\/?p=79"},"modified":"2022-11-05T10:53:18","modified_gmt":"2022-11-05T10:53:18","slug":"leaky-print-spooler-vulnerability-cve-2021-1675","status":"publish","type":"post","link":"https:\/\/geekmungus.co.uk\/?p=79","title":{"rendered":"Leaky Print Spooler Vulnerability (CVE-2021-1675)"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">So it appears that there is a vulnerability identified in Microsoft Windows machines running Active Directory, this is covered on the Register: <a rel=\"noreferrer noopener\" href=\"https:\/\/www.theregister.com\/2021\/06\/30\/windows_print_spool_vuln_rce\/\" target=\"_blank\">https:\/\/www.theregister.com\/2021\/06\/30\/windows_print_spool_vuln_rce\/<\/a><br><br>Until you patch this you can just disable the &#8220;Printer Spooler&#8221; service on your Domain Controllers and well to be honest  you don&#8217;t need this running on the Domain Controller anyway.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Edit: The issue appears to affect all Windows Servers, so if you are not using the printer spooler you should disable it and patch ASAP where the printer spooler is used.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Edit 2: There is a workaround for until a patch is available: <a href=\"https:\/\/blog.truesec.com\/2021\/06\/30\/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available\/\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/blog.truesec.com\/2021\/06\/30\/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available\/<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Edit 3: Okay here&#8217;s some more information, it turns out there was a patch for PrintNightmare CVE-2021-1675 released. This protects almost all windows devices&#8230;..apart from Domain Controllers it would seem.<br><br>Basically it looks like <em>Sangfor Technologies <\/em>released a zero day exploit assuming what they had discovered was actually already patched in&nbsp;<em>CVE-2021-1675<\/em>, but it wasn&#8217;t&#8230;.whoops (citation). However at the moment, other than hacking around removing groups etc from the domain controllers as this&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https:\/\/www.theregister.com\/2021\/07\/01\/printnightmare_windows_fix\/\">suggests<\/a>. It appears applying the patch resolves on everything but domain controllers. <br><br>And on domain controllers you should disable the printer spooler for now and wait for it to all blow over as per:&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2021-34527\">https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2021-34527<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Edit 4: Microsoft have now released this guidance: <a rel=\"noreferrer noopener\" href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2021-34527\" target=\"_blank\">https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2021-34527<\/a> which should probably be treated as the approach to use.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/unsplash.com\/@markusspiske\" data-type=\"URL\" data-id=\"https:\/\/unsplash.com\/@markusspiske\" target=\"_blank\" rel=\"noreferrer noopener\">Image Attribution<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>So it appears that there is a vulnerability identified in Microsoft Windows machines running Active Directory, this is covered on the Register: https:\/\/www.theregister.com\/2021\/06\/30\/windows_print_spool_vuln_rce\/ Until you patch this you can just disable the &#8220;Printer Spooler&#8221; service on your Domain Controllers and well to be honest you don&#8217;t need this running on the Domain Controller anyway. Edit: &#8230; <a title=\"Leaky Print Spooler Vulnerability (CVE-2021-1675)\" class=\"read-more\" href=\"https:\/\/geekmungus.co.uk\/?p=79\" aria-label=\"Read more about Leaky Print Spooler Vulnerability (CVE-2021-1675)\">Read more<\/a><\/p>\n","protected":false},"author":4,"featured_media":137,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[27,14,22],"tags":[],"class_list":["post-79","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-active-directory","category-microsoft-windows","category-security"],"_links":{"self":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/79","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=79"}],"version-history":[{"count":1,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/79\/revisions"}],"predecessor-version":[{"id":1373,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/79\/revisions\/1373"}],"wp:attachment":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=79"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=79"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=79"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}