Click HERE to get the patch from patch.

by Mitja Kolsek, the 0patch Team

print-spooler

 

[Note: This blog post is expected to be updated as new micropatches are issued and new information becomes available.]

 

Update 7/5/2021: Security researcher cube0x0 discovered another attack vector for this vulnerability, which significantly expands the set of affected machines. While the original attack vector was Print System Remote Protocol [MS-RPRN], the same attack delivered via Print System Asynchronous Remote Protocol [MS-PAR] does not require Windows server to be a domain controller, or Windows 10 machine to have UAC User Account Control disabled or PointAndPrint NoWarningNoElevationOnInstall enabled. Note that our patches for Servers 2019, 2016, 2012 R2 and 2008 R2 issued on 7/2/2021 are effective against this new attack vector and don’t need to be updated.

 

Introduction

June 2021 Windows Updates brought a fix for a vulnerability CVE-2021-1675 originally titled “Windows Print Spooler Local Code Execution Vulnerability”. As usual, Microsoft’s advisory provided very little information about the vulnerability, and very few probably noticed that about two weeks later, the advisory was updated to change “Local Code Execution” to “Remote Code Execution”.

This CVE ID would probably remain one of the boring ones without a surprise publication of a proof-of-concept for a remote code execution vulnerability called PrintNightmare, indicating that it was  CVE-2021-1675. Security researchers Zhiniang Peng and Xuefeng Li, who published this POC, believed that their vulnerability was already fixed by Microsoft, and saw other researchers slowly leaking details, so they decided to publish their work as well.

It turned out that PrintNightmare was not, in fact, CVE-2021-1675 – and the published details and POC were for a yet unpatched vulnerability that turned out to allow remote code execution on all Windows Servers from version 2019 back to at least version 2008, especially if they were configured as domain controllers.

The security community went scrambling to clear the confusion, identify conditions for exploitability, and find workarounds in absence of an official fix from Microsoft. Meanwhile, PrintNightmare started getting actively exploited, Microsoft has confirmed it to be a separate vulnerability to CVE-2021-1675, assigned it CVE-2021-34527, and recommended that affected users either disable the Print Spooler service or disable inbound remote printing.

In addition to Microsoft’s recommendations, workarounds gathered from the community included removing Authenticated Users from the “Pre-Windows 2000 Compatible Access” group, and setting permissions on print spooler folders to prevent the attack.

All these mitigations can have unwanted and unexpected side effects that can break functionalities in production (1, 2, 3), some including those unrelated to printing.

Patching the Nightmare

 

Long story short, our team at 0patch has analyzed the vulnerability and created micropatches for different affected Windows versions, starting with those most critical and most widely used:

  1. Windows Server 2019 (updated with June 2021 Updates)
  2. Windows Server 2016 (updated with June 2021 Updates)
  3. Windows Server 2012 R2 (updated with June 2021 Updates)
  4. Windows Server 2008 R2 (updated with January 2020 Updates, no Extended Security Updates) 
  5. Windows 10 v20H2 (updated with June 2021 Updates)
  6. Windows 10 v2004 (updated with June 2021 Updates) 
  7. Windows 10 v1909 (updated with June 2021 Updates) 
  8. Windows 10 v1903 (updated with June 2021 Updates)
  9. Windows 10 v1809 (updated with May 2021 Updates – latest before end of support)
  10. Windows 10 v1803 (updated with May 2021 Updates – latest before end of support)
  11. Windows 10 v1709 (updated with October 2020 Updates – latest before end of support)

 

[Note: Additional patches will be released as needed based on exploitability on different Windows platforms.]

Our micropatches prevent the APD_INSTALL_WARNED_DRIVER flag in dwFileCopyFlags of function AddPrinterDriverEx from bypassing the object access check, which allowed the attack to succeed. We believe that “install warned drivers” functionality is not a very often used one, and breaking it in exchange for securing Windows machines from trivial remote exploitation is a good trade-off.

Micropatches for PrintNightmare will be free until Microsoft has issued an official fix. If you want to use them, create a free account at 0patch Central, then install and register 0patch Agent from 0patch.com. Everything else will happen automatically. No computer reboots will be needed.

Compatibility note: Some Windows 10 and Server systems exhibit occasional timeouts in the Software Protection Platform Service (sppsvc.exe) on a system running 0patch Agent. This looks like a bug in Windows Code Integrity mitigation that prevents a 0patch component to be injected in the service (which is okay) but sometimes also does a lot of seemingly meaningless processing that causes process startup to time out. As a result, various licensing-related errors can occur. The issue, should it occur, can be resolved by excluding sppsvc.exe from 0patch injection as described in this article.

Frequently Asked Questions

Q: Which Windows versions are affected by PrintNightmare?

Answer updated 7/5/2021: Due to the discovery of a new attack vector, which also affects non-DC servers and Windows 10 machines in their default configuration, the set of affected Windows platforms has significantly expanded. The current status, according to our tests, is this:

  • Windows Server 2019, whether DC or not – affected
  • Windows Server 2016, whether DC or not – affected
  • Windows Server 2012 R2, whether DC or not – affected
  • Windows Server 2012 non-R2, whether DC or not – not affected
  • Windows Server 2008 R2, whether DC or not – affected
  • Windows Server 2008 non-R2, whether DC or not – not affected
  • Windows Server 2003, whether DC or not – not affected
  • Windows 10 (all versions), domain-joined – not affected
  • Windows 10 (all versions), non domain-joined – affected
  • Windows 7 – not affected

 

Our remote attacks on Windows 10 were so far not successful against domain-joined Windows 10 machines, where the attack would be most worrisome. We were so far only able to launch the exploit using credentials of a local user on a non-domain Windows 10 machine, and such credentials are likely not known to an attacker. So these tests so far only confirm a possible local privilege escalation (a local user exploiting PrintNightmare to gain local System privileges).

 

Our current understanding is that without any custom configuration and with June 2021 Windows Updates applied, only Windows Servers that act as a domain controller are affected (confirmed for versions 2012, 2016 and 2019). The reason seems to be that when a server is a domain controller, a Pre-Windows 2000 Compatible Access group is created for some legacy compatibility, and the Authenticated Users group is a member of this group. This makes all domain users a member of Pre-Windows 2000 Compatible Access group, which is an important piece of the puzzle for exploiting this vulnerability.

However, non-DC servers and Windows 10 systems with June 2021 updates can also be vulnerable in at least these cases:

  • UAC (User Account Control) is completely disabled [source], or
  • PointAndPrint NoWarningNoElevationOnInstall is enabled [source].

 

 

Q: How about Windows systems without June 2021 Windows Updates?

We believe that without June 2021 Windows Updates, all supported Windows systems, i.e., all servers from 2012 up and all Windows 10 systems, are affected [source].

 

Q: What will happen with these micropatches when Microsoft issues their own fix for PrintNightmare?

First off, we absolutely recommend you do install all available security updates from original vendors.When Microsoft fixes PrintNightmare, their update will almost certainly replace localspl.dll, where the vulnerability resides, and where our micropatches are getting applied. Applying the update will therefore modify the cryptographic hash of this file, and 0patch will stop applying our micropatches to it. You won’t have to do anything in 0patch (such as disabling a micropatch), this will all happen automatically by 0patch design.

When the official fix is available, our micropatches will stop being free, and will fall under the 0patch PRO license. This means that if you wish to continue using them (and many other micropatches that the PRO license includes), you will have to purchase the appropriate amount of licenses.

Q: We have a lot of affected computers. How can we prepare for the next Windows 0day?

Obviously deploying 0patch in an enterprise production environment on a Friday afternoon is not something most organizations would find optimal. As with any enterprise software, we recommend testing 0patch with your existing software on a group of testing computers before deploying across your network. Please contact [email protected] for setting up a trial, and when the next 0day like this comes out, you’ll be ready to just flip a switch in 0patch Central and go home for the weekend.

Credits

We’d like to thank Will Dormann of CERT/CC for behind-the-scenes technical discussion that helped us understand the issue and decide on the best way to patch it.

Please revisit this blog post for updates or follow 0patch on Twitter.