Microsoft Issues Emergency Patch for Windows Flaw

Summary: Microsoft issued an out-of-band emergency update on Tuesday to fix CVE-2021-34527, a critical flaw in the Windows Print Spooler service in all supported Windows versions that attackers can exploit to run code of their choice, and Microsoft says it has already detected active exploitation. The fix came a week before the normal Patch Tuesday release and after exploit code for the flaw, dubbed PrintNightmare, was published; Microsoft said fixes were delayed for Windows Server 2016, Windows 10 version 1607, and Windows Server 2012, and the update also restricts printer operators to installing only signed printer drivers.
Key Takeaway: Researcher Benjamin Delpy reported the exploit still works on a fully patched Windows server when Point & Print is enabled, a feature organizations commonly turn on via group policy so users can install printer updates without IT approval.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-34527
Related: CVE-2021-34527: Microsoft Windows Print Spooler Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021
Microsoft Patch Tuesday, July 2021 Edition Cyber Risks ·
Threat Brief: Windows Print Spooler RCE Vulnerability (CVE-2021-34527 AKA Print Nightmare) Cyber Risks ·