It’s déjà vu all over again. Microsoft has issued a warning for a vulnerability in the Windows Print Spooler utility that can be exploited to enable remote code execution with SYSTEM privileges.
Similar vulnerabilities were revealed in June and July. The one with the most brand recognition is CVE-2021-34527, better known as “PrintNightmare,” but several other security flaws related to Print Spooler have been revealed in the weeks surrounding that particularly well-named issue.
It’s often seemed like Microsoft has scrambled to keep up with these vulnerabilities. The company released an emergency patch for PrintNightmare shortly after its disclosure, but that update didn’t completely prevent attackers from exploiting the flaw to remotely execute code.
That was supposed end on Aug. 10. Microsoft said it changed “the default Point and Print driver installation and update behavior to require administrator privileges” in an effort to “mitigate the publicly documented vulnerabilities in the Windows Print Spooler service.”
But then it announced CVE-2021-36958 on Aug. 11. “A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations,” Microsoft said, which could give hackers essentially unfettered access to a targeted system.
“An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges,” Microsoft said. “An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.”
By now it’s easy to guess how Microsoft advised Windows users to defend themselves: disabling Print Spooler. (Which in turn prevents the PC in question from printing anything.) The company said it’s currently investigating which versions of Windows are subject to this vulnerability.
