{"uuid": "033d2922-03a3-4798-b4ec-a1ba4c42066e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-36958", "type": "seen", "source": "https://t.me/hacking_Attack/20095", "content": "Black Hat Ethical Hacking\nMicrosoft Warns: Another Unpatched PrintNightmare Zero-Day\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Microsoft Warns: Another Unpatched PrintNightmare Zero-DayPost Views: 141 \nReading Time: 1 Minute\nOne day after dropping its scheduled August Patch Tuesday update, Microsoft issued a warning about yet another unpatched privilege escalation/remote code-execution (RCE) vulnerability in the Windows Print Spooler.\nThe zero-day bug, tracked as CVE-2021-36958, carries a CVSS vulnerability-severity scale rating of 7.3, meaning that it\u2019s rated as \u201cimportant.\u201d Microsoft said that it allows for a local attack vector requiring user interaction, but that the attack complexity is low, with few privileges required.\n\n\u201cA remote code-execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations,\u201d the computing giant explained in its Wednesday advisory. \u201cAn attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change or delete data; or create new accounts with full user rights.\u201d\n\nThe CERT Coordination Center actually flagged the issue in mid-July, when it warned that a working exploit\u00a0was available. That proof-of-concept (PoC), issued by Benjamin Delpy, comes complete with a video.\nSo apparently @offenseindepth reported this to Microsoft before your public PoC on July 17?\nAnd Microsoft is only just now publishing an out-of-band bulletin on it on August 11?\nhttps://s.w.org/images/core/emoji/13.1.0/72x72/1f914.png pic.twitter.com/8eDHD7tg7A\n\n\u2014 Will Dormann (@wdormann) August 11, 2021\nSee Also: Auth Bypass Bug Exploited, Affecting Millions of Routers On Thursday, CERT/CC issued more details on the issue, explaining that it arises from an oversight in signature requirements around the \u201cPoint and Print\u201d capability, which allows users without administrative privileges to install printer drivers that execute with SYSTEM privileges via the Print Spooler service.\n\nWhile Microsoft requires that printers installable via Point are either signed by a WHQL release signature or by a trusted certificate, Windows printer drivers can specify queue-specific files that are associated with the use of the device, which leaves a loophole for malicious actors.\n\n\u201cFor example, a shared printer can specify a CopyFiles directive for arbitrary files,\u201d according to the CERT/CC advisory. \u201cThese files, which may be copied over alongside the digital-signature-enforced printer driver files, are not covered by any signature requirement. Furthermore, these files can be used to overwrite any of the signature-verified files that were placed on a system during printer driver install. This can allow for local privilege escalation to SYSTEM on a vulnerable system.\u201d\nSee Also: Offensive Security Tool: Mimikatz Microsoft credited Victor Mata of FusionX at Accenture Security with originally reporting the issue, which Mata said occurred back in December 2020:\nHey guys, I reported the vulnerability in Dec'20 but haven't disclosed details at MSRC's request. It looks like they acknowledged it today due to the recent events with print spooler.\n\n\u2014 Victor Mata (@offenseindepth) August 11, 2021\nSo far, Microsoft hasn\u2019t seen any attacks in the wild using the bug, but it noted that exploitation is \u201cmore likely.\u201d With a working exploit in circulation, that seems a fair assessment. Print Spooler-Palooza and the PrintNightmareDelpy characterized this latest zero-day as being part of the string of Print Spooler bugs collectively known as PrintNightmare.\n\nThe bad dream started in early[...]", "creation_timestamp": "2026-09-01T20:02:28.458561Z"}