Microsoft Finds One More Windows Print Spooler Zero-day Bug

Share post:

Microsoft has released an advisory for another zero-day Windows print spooler vulnerability called CVE-2021-36958 that allows local attackers to gain SYSTEM privileges on a computer.

This vulnerability is part of a class of bugs known as “PrintNightmare” that misuse configuration settings for the Windows print spooler, printer drivers, and Windows Point and Print function.

Microsoft released security updates in both July and August to fix several vulnerabilities in PrintNightmare.

A zero-day vulnerability in the Windows Print Spooler, identified by security expert Benjamin Delpy as CVE-2021-36958, allows threat actors to quickly gain SYSTEM privileges by simply connecting to a remote print server.

While Microsoft’s recent security updates have changed the installation procedures for printer drivers to require admin privileges, users do not need to enter admin privileges to connect to a printer if that driver is already installed.

If the driver is on a client and thus does not need to be installed, the connection to a remote printer will still execute the CopyFile directive for non-administrators.

This vulnerability allows Delpy’s DLL to be copied to the client and executed to open a SYSTEM-level command prompt.

For more information, read the original story in BleepingComputer.

SUBSCRIBE NOW

Related articles

Anthropic Warns: AI “Virtual Employees” Could Pose Security Risks Within a Year

Anthropic, a leading artificial intelligence company, anticipates that AI-powered virtual employees could begin operating within corporate networks as...

Hertz Data Breach Exposes Customer Information via Supply Chain Hack

Hertz has disclosed a data breach resulting from a cyberattack on its vendor, Cleo Communications, which compromised sensitive...

Google’s New Security Feature – Automatic Reboot

Google is introducing a new security feature in its latest Android update that will automatically reboot phones and...

Cybersecurity Firm Prodaft Buys Hacker Forum Accounts to Monitor Cybercriminal Activity

Swiss cybersecurity company Prodaft has initiated a program to purchase verified and aged accounts on hacking forums, aiming...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways