Microsoft is starting to roll out patches for the scary “PrintNightmare” vulnerability, which can help a hacker remotely take over a Windows PC.
The patches target most versions of Windows, including the latest version of Windows 10 21H1, and Windows 7 Service Pack 1. However, the company has yet to release the security fixes for Windows 10 Version 1607, Windows Server 2016 and Windows Server 2012. So some users may still need to wait.
The available patches should install automatically via Windows Update. For PCs running the newest version of Windows 10, the patch will arrive with the name KB5004945. You can also download the patches individually from the company’s webpage documenting the vulnerability.
According to Microsoft, the flaw affects all versions of Windows because it involves Print Spooler, a persistent feature in the operating system. Hence, the vulnerability has been dubbed PrintNightmare for its potential to affect millions of PCs across the globe.
Print Spooler is designed to act as a general interface for print jobs. However, security researchers discovered the same function can be remotely manipulated to execute computer code on a Windows PC with system privileges.
The vulnerability was highlighted when security researchers accidentally published a working exploit leveraging PrintNightmare. Making matters worse is how Print Spooler is turned on by default on Windows machines, and will only deactivate if the PC shuts down.
Fortunately, the attack can only be pulled off if the hacker has access to your PC’s internet network. The bigger danger is for enterprises, which operate hundreds, if not thousands of computers, across their networks. As a result, a hacker who’s managed to infiltrate one PC on a corporate network could exploit PrintNightmare to unleash havoc.
“If they can secure any kind of access, they can potentially use PrintNightmare to turn a normal user into an all-powerful Domain Admin,” the security firm Malwarebytes warned. “As a Domain Admin they could then act almost with impunity, spreading ransomware, deleting backups and even disabling security software.”
Although the Microsoft patch is good news, the security fix isn’t complete either. The CERT Coordination Center notes the patch doesn’t appear to prevent a hacker from using the vulnerability to escalate privileges on a Windows PC if the system has already been compromised. However, Microsoft has developed a workaround IT admins can use to manually disable Print Spooler over their computers.
