Microsoft Finds One More Windows Print Spooler Zero-day Bug

Share post:

Microsoft has released an advisory for another zero-day Windows print spooler vulnerability called CVE-2021-36958 that allows local attackers to gain SYSTEM privileges on a computer.

This vulnerability is part of a class of bugs known as “PrintNightmare” that misuse configuration settings for the Windows print spooler, printer drivers, and Windows Point and Print function.

Microsoft released security updates in both July and August to fix several vulnerabilities in PrintNightmare.

A zero-day vulnerability in the Windows Print Spooler, identified by security expert Benjamin Delpy as CVE-2021-36958, allows threat actors to quickly gain SYSTEM privileges by simply connecting to a remote print server.

While Microsoft’s recent security updates have changed the installation procedures for printer drivers to require admin privileges, users do not need to enter admin privileges to connect to a printer if that driver is already installed.

If the driver is on a client and thus does not need to be installed, the connection to a remote printer will still execute the CopyFile directive for non-administrators.

This vulnerability allows Delpy’s DLL to be copied to the client and executed to open a SYSTEM-level command prompt.

For more information, read the original story in BleepingComputer.


Related articles

Cyber Security Today, Week in Review for week ending Friday May 17, 2024

Welcome to Cyber Security Today. This is the Week in Review for the week ending Friday, May 17th,...

Cyber Security Today, May 17, 2024 – Malware hiding in Apache Tomcat servers

Malware hiding in Apache Tomcat servers, new backdoors found, and more Welcome to Cyber Security Today. It's Friday, May...

MIT students exploit blockchain vulnerability to steal 25 million dollars

Two MIT students have been implicated in a highly sophisticated cryptocurrency heist, where they reportedly exploited a vulnerability...

Cyber Security Today, May 15, 2024 – Ebury botnet still exploits Linux servers, Microsoft, SAP and Apple issue security updates

The Ebury botnet continues to exploit Linux servers, Microsoft, SAP and Apple issue security updates, and more. Welcome to...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways