PrintDemon vulnerability impacts all Windows versions

mood · May 14, 2020

PrintDemon vulnerability impacts all Windows versions
...as far back as 1996. Patches available.
May 13, 2020
https://www.zdnet.com/article/printdemon-vulnerability-impacts-all-windows-versions/

Two security researchers have published today details about a vulnerability in the Windows printing service that they say impacts all Windows versions going back to Windows NT 4, released in 1996.

The vulnerability, which they codenamed PrintDemon, is located in Windows Print Spooler, the primary Windows component responsible for managing print operations.
TRIVIALLY EXPLOITABLE LOCAL PRIVILEGE ELEVATION
In a report published today, security researchers Alex Ionescu & Yarden Shafir said they found a bug in this old component that can be abused to hijack the Printer Spooler internal mechanism.

The bug can't be used to break into a Windows client remotely over the internet, so it's not something that could be exploited to hack Windows systems at random over the internet.
Click to expand...

PrintDemon is what researchers call a "local privilege escalation" (LPE) vulnerability. This means that once an attacker has even the tiniest foothold inside an app or a Windows machine, even with user-mode privileges, the attacker can run something as simple as one unprivileged PowerShell command to gain administrator-level privileges over the entire OS.

In a tweet today, Ionescu said exploitation on current OS versions requires one single line of PowerShell. On older Windows versions, this might need some tweaking.
"On an unpatched system, this will install a persistent backdoor, that won't go away *even after you patch*," Ionescu said.
PATCHES AVAILABLE
The good news is that this has now been patched, hence Ionescu and Shafir's public disclosure. Fixes for PrintDemon have been released yesterday, with the Microsoft May 2020 Patch Tuesday.
Click to expand...

PrintDemon: Print Spooler Privilege Escalation, Persistence & Stealth (CVE-2020-1048 & more)

This bug is ridiculously easy to exploit, both as an interactive user and from limited remote-local contexts as well.
Click to expand...

mood · Aug 6, 2020

Unpatched bug in Windows print spooler lets malware run as admin
Researchers found a way to bypass a patch Microsoft released to address a bug in the Windows printing services
August 6, 2020
https://www.bleepingcomputer.com/ne...dows-print-spooler-lets-malware-run-as-admin/

Tracked as CVE-2020-1048, the initial flaw received an initial fix in May and another one is coming with this month’s roll out of security updates from Microsoft.
New patch on the way
Discovered and reported responsibly by Peleg Hadar and Tomer Bar of SafeBreach Labs, CVE-2020-1048 affects Windows Print Spooler, the service that manages the printing process.

Bypassing it has been classified as a new vulnerability that received the tracking number CVE-2020-1337. A fix will become available on August 11.
Click to expand...

Exploiting CVE-2020-1048 is possible by crafting malicious files parsed by the spooler.
“As a bonus, multiple Windows services loaded our DLL (wbemcomn.dll) as they didn’t verify the signature and tried to load the DLL from an unexisting path, meaning we also got code execution” the two researchers said.
Click to expand...

Log in or Sign up

PrintDemon vulnerability impacts all Windows versions

mood Updates Team

mood Updates Team

Log in or Sign up

PrintDemon vulnerability impacts all Windows versions

mood Updates Team

mood Updates Team

Useful Searches