Cyber Risks · Unit 42 Palo Alto Networks

Threat Brief: Windows Print Spooler RCE Vulnerability (CVE-2021-34527 AKA Print Nightmare)

Summary: On July 1, 2021, Microsoft issued a security advisory for CVE-2021-34527, a remote code execution vulnerability in Windows publicly called "PrintNightmare," which researchers initially believed was tied to CVE-2021-1675 disclosed in the June 8, 2021 Patch Tuesday release. Microsoft later clarified the two are similar but distinct, affecting RpcAddPrinterDriverEx(), and said all Windows versions are affected, including domain controllers, clients and member servers running the Print Spooler service, with an out-of-band update released July 6, 2021, except for Windows 10 version 1607, Windows Server 2016 and Windows Server 2012, where an update was still expected.
Key Takeaway: Every Windows version is exposed through the Print Spooler service, and the July 6, 2021 out-of-band update did not yet cover Windows 10 version 1607, Windows Server 2016 or Windows Server 2012 - leaving domain controllers and member servers on those versions without a fix at the time.

Read the original at Unit 42 Palo Alto Networks ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-1675 CVE-2021-34527
Related: Print Nightmare: Here’s what you need to know and Talos’ coverage Cyber Risks ·
Vice Society leverages Print Nightmare in ransomware attacks Cyber Risks ·
Threat Source newsletter (Aug. 19, 2021) Cyber Risks ·