This message was deleted.
# _generals
Slackbot
06/30/2021, 9:08 PMThis message was deleted.
👍 1
n
Nathan Shaw
07/01/2021, 7:26 AMYep, interesting entry point with the driver rollback.
r
Rachel Berry
07/01/2021, 9:56 AMMarius is publishing a lot about this https://msandbu.org/printnightmare-cve-2021-1675/
m
Mike Gray
07/01/2021, 5:03 PMYep we're disabling via GPO on all infrastructure servers....
🙌 1
r
Rachel Berry
07/05/2021, 12:34 PMRemko has a useful explanation of disabling via GPO https://twitter.com/RemkoWeijnen/status/1412001026895400961?s=20
a
Arthur
07/06/2021, 10:04 AMRecommendation for RDSH / VDI workers:
Disable inbound remote printing through Group Policy
You can also configure the settings via Group Policy as follows:
Computer Configuration / Administrative Templates / Printers
Disable the “Allow Print Spooler to accept client connections:” policy to block remote attacks.
You must restart the Print Spooler service for the group policy to take effect.
Impact of workaround This policy will block the remote attack vector by preventing inbound remote printing operations. The system will no longer function as a print server, but local printing to a directly attached device will still be possible.
r
Robert Magasi
07/06/2021, 11:31 AMHi All, I think disabling "Allow Print Spooler to accept client connections" doesn't really help. If the user gets a malware the vulnerability can still be used very easily. What do you think?
Robert Magasi
07/06/2021, 11:32 AMThere is a script I executed as normal user, this GPO was set to disable, and It created a local admin account in seconds.
a
Arthur
07/06/2021, 11:34 AMAnyone can test exploit to confirm?
r
Robert Magasi
07/06/2021, 11:36 AMRobert Magasi
07/06/2021, 11:36 AMselect 5 then 12
a
Arthur
07/06/2021, 12:08 PMPlease let us know about results.