The emergency patch for the PrintNightmare vulnerability released by Microsoft is incomplete and still allows RCE.

Yesterday, Microsoft has released an out-of-band KB5004945 security update to address the PrintNightmare vulnerability, unfortunately, the patch is incomplete and still allows remote code execution.

Researchers have demonstrated that it is possible to bypass the emergency patch to achieve remote code execution and local privilege escalation on systems that have installed it.

Shortly after the release of the patch, the popular researcher Matthew Hickey noticed that the fix is incomplete and that threat actors and malware can still locally exploit the vulnerability to gain SYSTEM privileges.

The Microsoft fix released for recent #PrintNightmare vulnerability addresses the remote vector – however the LPE variations still function. These work out of the box on Windows 7, 8, 8.1, 2008 and 2012 but require Point&Print configured for Windows 2016,2019,10 & 11(?). https://t.co/PRO3p99CFo— Hacker Fantastic (@hackerfantastic) July 6, 2021The failure of the Microsoft update was also reported by Will Dormann, a vulnerability analyst for CERT/CC.

Other researchers started testing the patch and demonstrated that it was possible to entirely bypass the fix to achieve both RCE and local privilege escalation (LPE).

The expert Benjamin Delpy, also known for having developed the popular Mimikatz tool, discovered that when the Point and Print policy is enabled, attackers could bypass the patch to achieve Remote Code Execution.

Dealing with strings & filenames is hardNew function in #mimikatz to normalize filenames (bypassing checks by using UNC instead of servershare format)So a RCE (and LPE) with #printnightmare on a fully patched server, with Point & Print enabled> https://t.co/Wzb5GAfWfd pic.twitter.com/HTDf004N7r— Benjamin Delpy (@gentilkiwi) July 7, 2021Later, Delpy’s discovery was also confirmed by Dormann:

Confirmed.If you have a system where PointAndPrint NoWarningNoElevationOnInstall = 1, then Microsoft’s patch for #PrintNightmare CVE-2021-34527 does nothing to prevent either LPE or RCE. https://t.co/RgIc1yrnhn pic.twitter.com/Ntxe9wpuke— Will Dormann (@wdormann) July 7, 2021Delpy shared a screenshot of a reversed-engineered Windows DLL with The Register and explained that the issues ties how Microsoft was checking for remote libraries in its patch for PrintNightmare.

The policy is available under Computer Configuration > Administrative Templates > Printers > Point and Print Restrictions.

At this point, Windows have no reason to install the July 6th patch and waiting for the patch they are recommended to disable the Print Spooler.

Follow me on Twitter: @securityaffairs and Facebook

try {
window._mNHandle.queue.push(function (){
window._mNDetails.loadTag(“816788371”, “300×250”, “816788371”);
});
}
catch (error) {}

try {
window._mNHandle.queue.push(function (){
window._mNDetails.loadTag(“816788371”, “300×250”, “816788371”);
});
}
catch (error) {}
Pierluigi Paganini

(SecurityAffairs – hacking, PrintNightmare)

The post Experts bypassed Microsoft’s emergency patch for the PrintNightmare appeared first on Security Affairs.