QID 91786

Date Published: 2021-07-08

QID 91786: Microsoft Windows Print Spooler Point and Print Insecure Configuration Detected (PrintNightmare)

The Print Spooler is software built into the Windows operating system that temporarily stores print jobs in the computer's memory until the printer is ready to print them.

On 07/06/2021, Microsoft released updates to fix CVE-2021-34527 (PrintNightmare). Microsoft has confirmed in the description of CVE-2021-34527 that having 'Point and Print Restrictions' enabled, and the "When installing drivers for a new connection" setting configured to "Do not show warning on elevation prompt." will leave systems vulnerable by design.

QID Detection Logic (authenticated):
The QID check if Printer Spooler Service and if 'Point and Print Restrictions' is enabled, and the "When installing drivers for a new connection" setting is configured to "Do not show warning on elevation prompt." via registry key HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint value NoWarningNoElevationOnInstall is set to 1

Successful exploitation allows an attacker to execute arbitrary code with SYSTEM privileges.

CVSS V3 rated as Critical - 8.8 severity.

CVSS V2 rated as Critical - 9 severity.

Solution

Currently, there is no patch available for this vulnerability.

Workaround:
Determine if the Print Spooler service is running:
Run the following:
Get-Service -Name Spooler
If the Print Spooler is running or if the service is not set to disabled, select one of the following options to either disable the Print Spooler service, or to Disable inbound remote printing through Group Policy:

Option 1:
In order to secure your system, customers need to apply latest updates immediately and confirm settings are set to 0 (zero) or are not defined (Note: These registry keys do not exist by default.) for below registry values:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint NoWarningNoElevationOnInstall = 0 (DWORD) or not defined (default setting)
NoWarningNoElevationOnUpdate = 0 (DWORD) or not defined (default setting)
Option 2:
Disable the Print Spooler service:
If disabling the Print Spooler service is appropriate for your enterprise, use the following PowerShell commands: Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled
Impact of workaround: Disabling the Print Spooler service disables the ability to print both locally and remotely.

Vendor References

CVEs related to QID 91786

Software Advisories

Advisory ID	Software	Component	Link

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].