Microsoft responds to PrintNightmare by making life that little bit harder for admins
- Reference: 1628682854
- News link: https://www.theregister.co.uk/2021/08/11/printnightmare_mitigation/
- Source link:
As a reminder (if one were needed), [2]PrintNightmare began life as an [3]accidentally disclosed zero-day at the end of June and permitted an attacker to run arbitrary code on Windows with SYSTEM privileges. A flaw in the Windows Printer Spooler service allowed miscreants to potentially run riot on exposed systems.
Security researchers pressed the hole and further vulnerabilities oozed out of the Print Spooler service.
[4]
Having initially told users to shut down Print Spooler, Microsoft's latest missive means it will require administrator privileges for Point and Print driver installation, a change that will hit all supported versions of Windows and turned up in [5]this week's round of patches .
[6]
[7]
"This change may impact Windows print clients in scenarios where non-elevated users were previously able to add or update printers," said Microsoft. "However, we strongly believe that the security risk justifies this change."
Requiring an administrator for changes to printer drivers could cause a few headaches for some enterprises. The fix can also be turned off via a registry key, something Microsoft advised against. "Disabling this mitigation will expose your environment to the publicly known vulnerabilities in the Windows Print Spooler service," it said, "and we recommend administrators assess their security needs before assuming this risk."
[8]Microsoft Patch Tuesday bug drought: No, it's not climate change or unexpected code quality improvements
[9]Make-me-admin holes found in Windows, Linux kernel
[10]You'll want to shut down the Windows Print Spooler service (yes, again): Another privilege escalation bug found
[11]Microsoft struggles to wake from PrintNightmare: Latest print spooler patch can be bypassed, researchers say
The problem is that it might not resolve all the vulnerabilities uncovered by researchers. Benjamin Delpy, head of R&D Security at Banque de France and author of Mimikatz, told The Register "it does NOT fix" the PrintNightmare vulnerability he found.
Delpy also posted the inevitable meme.
August PatchTuesday [12]#printnightmare [13]pic.twitter.com/qKex6THgBq — 🥝 Benjamin Delpy (@gentilkiwi) [14]August 11, 2021
Oh dear.
"They did not test their fix against the public server I created for everyone to test," explained Delpy, who also tweeted a summary of what the patch did.
Basicaly:
- assuming default value is "restrict install to admin" 1 now
- more check on remote files install path — 🥝 Benjamin Delpy (@gentilkiwi) [15]August 10, 2021
The Register has contacted Microsoft for its take and will update should the company respond. ®
Get our [16]Tech Resources
[1] https://msrc-blog.microsoft.com/2021/08/10/point-and-print-default-behavior-change/
[2] https://www.theregister.com/2021/07/02/printnightmare_cve/
[3] https://www.theregister.com/2021/06/30/windows_print_spool_vuln_rce/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YRP0NDgWqjzWbQ3A6hoR4QAAAAk&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://www.theregister.com/2021/08/10/microsoft_patch_tuesday/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YRP0NDgWqjzWbQ3A6hoR4QAAAAk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YRP0NDgWqjzWbQ3A6hoR4QAAAAk&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2021/08/10/microsoft_patch_tuesday/
[9] https://www.theregister.com/2021/07/21/windows_linux_privilege_escalation/
[10] https://www.theregister.com/2021/07/16/spooler_service_local_privilege_escalation/
[11] https://www.theregister.com/2021/07/07/printnightmare_fix_fail/
[12] https://twitter.com/hashtag/printnightmare?src=hash&ref_src=twsrc%5Etfw
[13] https://t.co/qKex6THgBq
[14] https://twitter.com/gentilkiwi/status/1425367298001543176?ref_src=twsrc%5Etfw
[15] https://twitter.com/gentilkiwi/status/1425198053917605902?ref_src=twsrc%5Etfw
[16] https://whitepapers.theregister.com/
No, it's all printers. And it's not just Windows.
I saw this somewhere recently: "I don't know what equipment infuriated Rage Against the Machine, but it was probably a printer"
You've possibly seen it [1]in these fora
[1] https://forums.theregister.com/forum/containing/4248961
It might be less than you think
One Dell printer on my network, a C2660, was also presenting itself as being fussy on Win10 systems.
Windows 10, at a "fundamental" level, wasn't the problem. The printer, wasn't the problem. The problem was that Microsoft choose to default to its standard, modular printer driver.
Delete the printer and re-install manually by selecting "The printer that I want wasn't listed" after it auto-searches in the Add Printer dialog. Then configure your printer using the exact specified driver for the printer model, not the default Microsoft-sourced one (if you do not have it, get it from the manufacturer direct).
Solved all my problems. Yes, I had to roll out this fix to all affected computers but it was worth the end of the flaky operations.
"Requiring an administrator for changes to printer drivers"
It is insane that a printer need any sort of admin access at all.
Then again, it's Windows, so insanity is baked in.
If only...
...printers could understand some kind of standard printer script that meant that we didn't need per-printer drivers. You could that post that script to any printer and the printer would print the document.
Re: If only...
Ahhh yes. The good old days of original/actual Mac OS.
Re: If only...
" ... that meant that we didn't need per-printer drivers "
It's in the interest of both printer manufacturers (for brand lock in) and OS vendors (to facilitate churn) that printer drivers are proprietary and versioned.
This is about revenue not printing. Essentially the entire IT industry now considers itself more important (to itself) than the users of its products.
However I do feel that rather than applying a sticking plaster by elevating the rights needed to control a flawed service, NS might have taken the trouble to fix the bug in the service.
Re: If only...
Isn't allowing users to upload arbitrary, Turing-complete "data" what got us into this mess in the first place? Although that's not why I'd never go back to postscript for love or money.
PDF might make sense.
Temporary workaround, or going back to the bad old days?
There have been a number of years where MS have been quite on top of patching, but with the mandatory bundles of security fixes changes, and trialing fixes on the section of the user base stupid enough to run the leading edge version I do wonder if this is going to worsen.
Certainly making plans to move even more personal stuff off Windows
Re: Temporary workaround, or going back to the bad old days?
It looks like they didn't do anything except change the registry entry that you used to have to change to allow non admins to install print drivers if all this is doing is requiring you to be admin.
Obilgatory....
Me: Get me a cup of tea
Significant other: No
Sudo me: Get me a cup of tea
Significant other: Okay, no problem
Re: Obilgatory....
You mean this https://xkcd.com/149/
Re: Have they forgotten SysAdmin Appreciation Day so soon?
To be fair, it was 4 years ago.
No more printing?
Oh well, using a computer to do actual work is kind of twentieth century, right?
I assumed that "printnightmare" just referred to the nightmare of getting a printer to consistently work on Windows these days. Might just be HP printers that applies to though.