- Reaction score
- 1,703
Proof-of-concept (PoC) exploit code has been accidentally released for a previously-unknown bug in the Microsoft Windows Print Spooler.
Researchers from Sangfor, a Chinese technology company, are due to present a paper at Black Hat USA on August 4 exploring local privilege escalation (LPE) and remote code execution (RCE) vulnerabilities in Windows Printer based on prior research into the ancient PrintDemon bug, resolved in 2020.
“Although security researchers in the industry have been looking for bugs in Spooler for more than a decade, this year, security researchers at Sangfor discovered multiple zero-day vulnerabilities in Spooler,” the company said.
One of the vulnerabilities due to be discussed, tracked as CVE-2021-1675 and issued with a CVSS score of 7.8, is a critical Print Spooler bug that was included in Microsoft’s latest Patch Tuesday, published on June 8.
On June 21, Microsoft revised its previous assessment that the vulnerability was only a privilege escalation issue, upgrading it to an RCE. Credit for finding the issue was given to researchers from Tencent Security Xuanwu Lab, AFINE, and NSFOCUS TIANJI Lab.
On June 27, Chinese cybersecurity firm QiAnXin published a video demonstrating both LPE and RCE.
As the vulnerability had been publicly upgraded to an RCE and a patch had been issued, Sangfor security researcher Zhiniang Peng then tweeted a link to Sangfor’s own PoC code and a technical write-up for the bug ahead of their Black Hat presentation.
However, it appears the vulnerability the PoC relates to – now dubbed “PrintNightmare” – is actually a zero-day that is yet to be patched by Microsoft, and not the vulnerability demoed in QiAnXin’s video.
Read more here. (The Daily Swig)
Researchers from Sangfor, a Chinese technology company, are due to present a paper at Black Hat USA on August 4 exploring local privilege escalation (LPE) and remote code execution (RCE) vulnerabilities in Windows Printer based on prior research into the ancient PrintDemon bug, resolved in 2020.
“Although security researchers in the industry have been looking for bugs in Spooler for more than a decade, this year, security researchers at Sangfor discovered multiple zero-day vulnerabilities in Spooler,” the company said.
One of the vulnerabilities due to be discussed, tracked as CVE-2021-1675 and issued with a CVSS score of 7.8, is a critical Print Spooler bug that was included in Microsoft’s latest Patch Tuesday, published on June 8.
On June 21, Microsoft revised its previous assessment that the vulnerability was only a privilege escalation issue, upgrading it to an RCE. Credit for finding the issue was given to researchers from Tencent Security Xuanwu Lab, AFINE, and NSFOCUS TIANJI Lab.
On June 27, Chinese cybersecurity firm QiAnXin published a video demonstrating both LPE and RCE.
As the vulnerability had been publicly upgraded to an RCE and a patch had been issued, Sangfor security researcher Zhiniang Peng then tweeted a link to Sangfor’s own PoC code and a technical write-up for the bug ahead of their Black Hat presentation.
However, it appears the vulnerability the PoC relates to – now dubbed “PrintNightmare” – is actually a zero-day that is yet to be patched by Microsoft, and not the vulnerability demoed in QiAnXin’s video.
Read more here. (The Daily Swig)
