Microsoft's Patch Tuesday update last week was meant to fix print vulnerabilities in Windows but also broke network printing for many, with some admins disabling security or removing the patch to get it working.

The problem is complex and first surfaced in January, when Microsoft issued this [1]support note explaining that "a security bypass vulnerability exists in the way the Printer Remote Procedure Call (RPC) binding handles authentication for the remote Winspool interface."

Microsoft's fix was in two phases, first to add a registry setting to increase the authorization level for remote access to printers and second, to inform admins that "the release transitions into the enforcement phase on September 14, 2021. Enforcement phase enforces the changes to address CVE-2021-1678 by increasing the authorization level without having to set the registry value." That September date was "Patch Tuesday" last week – though some admins were already having issues with network printing caused by Microsoft's other mitigation efforts.

[2]

The print nightmare escalated in June when researchers [3]discovered that the print spooler privilege execution vulnerability meant that a compromise of one desktop PC in a network could result in an attacker getting domain administration privileges, since the print spooler runs by default on servers including domain controllers.

[4]

[5]

This [6]discussion on Microsoft's question and answer forum for IT professionals shows the problems administrators now face. "This just hit us this morning too. 9/15/2021. No one can print to the network printers. I removed KB5005613 from our server and rebooted the server and that fixed it," [7]said one such last week – but removing a security patch is not a good solution as it leaves a known vulnerability in place.

[8]Microsoft responds to PrintNightmare by making life that little bit harder for admins

[9]You'll want to shut down the Windows Print Spooler service (yes, again): Another privilege escalation bug found

[10]Microsoft struggles to wake from PrintNightmare: Latest print spooler patch can be bypassed, researchers say

[11]Microsoft patches PrintNightmare – even on Windows 7 – but the terror isn't over

Another [12]found a fix that "worked immediately" – a Group Policy Object (GPO) setting which applies across all targeted computers on a Windows network called RestrictDriverInstallationToAdministrators = 0. Unfortunately, this too undoes the security Microsoft is trying to apply. Setting this is not recommended.

Although Microsoft has published a certain amount of information, it could do more in terms of providing guidance to administrators confronted with security issues on the one hand, and users demanding to be able to print on the other. Others have come up with guidance of their own, including [13]this security post which includes a flowchart to analyse print security in a network.

[14]

Unofficial flowchart for analysing print security on a Windows network

It appears that Microsoft has so far been unable to fix the vulnerabilities in Windows network printing by patching the code and has focused instead on tightening the security around it. A typical Windows network has printers of varying age, from various vendors, with various levels of support. Relevant factors include the way in which network printing is configured, the printer drivers used both on client and server, the version of Windows and its patch level, and the GPOs applied to the PCs.

The type of [15]printer driver called V4 is preferred for security but must be installed on the client. In the case of older versions of Windows such as Windows Server 2008 R2, for which extended support has expired, "customers are required to purchase the Extended Security Update," said Microsoft in the above-mentioned support note. Considering the complexity it is not surprising that some admins have complained of random behaviour.

"I really don't know if this breaks the PrinterNightmare fix. But our >3,000 customers had to print again..." said one admin in the discussion. That is not a good spot to be in and it seems the PrintNightmare saga is not over yet. We have asked Microsoft for further comment and will report back accordingly. ®

Get our [16]Tech Resources



[1] https://support.microsoft.com/en-us/topic/managing-deployment-of-printer-rpc-binding-changes-for-cve-2021-1678-kb4599464-12a69652-30b9-3d61-d9f7-7201623a8b25

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YUoBu4WPNZwciZ@uUWQKlAAAAEY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://www.theregister.com/2021/06/30/windows_print_spool_vuln_rce/

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YUoBu4WPNZwciZ@uUWQKlAAAAEY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YUoBu4WPNZwciZ@uUWQKlAAAAEY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[6] https://docs.microsoft.com/en-us/answers/questions/517533/pint-server-and-print-nightmare-update.html

[7] https://docs.microsoft.com/answers/comments/553922/view.html

[8] https://www.theregister.com/2021/08/11/printnightmare_mitigation/

[9] https://www.theregister.com/2021/07/16/spooler_service_local_privilege_escalation/

[10] https://www.theregister.com/2021/07/07/printnightmare_fix_fail/

[11] https://www.theregister.com/2021/07/07/printnightmare_patched/

[12] https://docs.microsoft.com/answers/comments/518963/view.html

[13] https://www.kb.cert.org/vuls/id/383432

[14] https://regmedia.co.uk/2021/09/21/printnightmare.jpg

[15] https://docs.microsoft.com/en-us/windows-hardware/drivers/print/v4-printer-driver

[16] https://whitepapers.theregister.com/