Microsoft Windows “Print Nightmare” Critical Vulnerability 

On June 29, 2021, a zero-day vulnerability affecting Windows print spoolers was widely publicized.

This critical vulnerability, which has not yet been patched, affects servers running Windows 7 and later versions.

An initial patch was released on July 8 by the publisher.

What Are the Risks to Your Business?

This vulnerability allows remote code execution, resulting in elevation of privileges to the system level, for any user with an Active Directory account. 

An attacker could install a program, view, modify, or delete data, or create a new account with full administrator privileges. 

Since this service is enabled by default, any Windows system is potentially vulnerable.

In addition, exploit code is publicly available on the Internet, which means that exploitation of this vulnerability is imminent or already underway.

How can you protect yourself from it?

As of Thursday, July 8, Microsoft recommends securing the operation of the “ Point and Print ” feature by ensuring that, if the registry keys exist (they do not by default), they are set to the following values:

  • The registry key NoWarningNoElevationOnInstall (HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint) must be absent or set to 0 (DWORD)
  • The registry key NoWarningNoElevationOnUpdate (same location) must be absent or set to 0 (DWORD)

Patches are now available for all supported versions of Microsoft Windows.

Visit the ANSSI website for a list of actions to take immediately

The CERT-FR advisory also recommends applying the patch immediately, even though it appears to address only remote arbitrary code execution and not local privilege escalation.

Note : Please note that versions that are no longer supported, such as Windows 10 Version 1903, are affected by the vulnerability but will not be patched.

Therefore, if the Print Spooler service is not in use, it should be disabled. 

The SOC ITrust teams remain particularly vigilant regarding the systems affected by this CVE.

>Our analysts monitor our clients' Windows servers and will take corrective action as needed.

>Regarding best practices: always remember to scan your network regularly. Tools like IKare, available with a free trial, automate the monitoring of your IT system.

If you need help fixing these issues, please contact us:

> Request a callback

> 05.67.34.67.80

> contact@itrust.fr