How Dangerous Is PrintNightmare Vulnerability: Microsoft Warns

There is new information about the exploit, known as PrintNightmare, which affects virtually all Windows devices. Microsoft is currently working on a fix and is gradually providing new information about the vulnerability.

The name “PrintNightmare” hides a security hole in the Windows print service that allows compromised printer drivers to be smuggled in via the “Print Spooler” as reported earlier. All Windows 10 versions are affected, including the server variants, as well as the older operating systems from Windows 7. The vulnerability uses the unprotected functions of the Windows Print Spooler service to trigger a remote code execution (RCE), i.e. to retrieve damaged code Execute targets of attack.

High Risk And Dangerous?

Microsoft has now added more details about PrintNightmare at CVE-2021-34527. It says, among other things, that Microsoft has given the vulnerability a CVSS base rating (Common Vulnerability Scoring System) of 8.8. That is still in the area that is classified as a high threat, the classification “critical” starts at 9.0 points. The base score can be a maximum of 10.0. The US security agency CISA, unlike Microsoft itself, classified the vulnerability as critical.

In addition, Microsoft made a time rating of 8.2 points. The temporal score measures the current exploitability of a vulnerability based on a number of factors: The base value is 8.8 because Microsoft has determined that the attack vector is at the network level, requires low attack complexity and low privileges, requires no user interaction, and leads to a ” Total loss “of the confidentiality, integrity, and availability of an organization’s resources can result. The temporal score is 8.2 because functional exploit code is readily available on the Internet and works across all versions of Windows, detailed reports exist on it, and some official workarounds have been suggested.

Patch Is On The Way

A similar vulnerability was fixed with the patch day update in June. This had a CVSS base score of 7.8. Until the next update is available from Microsoft, the recommended workaround is to disable the Windows Print Spooler service through Group Policy. A new recommendation is to check the memberships and the nested group membership of some entities. The company suggests keeping the number of members as low as possible and ideally setting it to zero if possible.

However, the company cautions that removing members from some of these groups could create compatibility issues. To keep up to date, one should contact the Microsoft Security Response Center for new information Search CVE-2021-34527.