Michael Trew graced us with on 7/12/2021 8:00 PM:
> Microsoft issues urgent security warning: Update your PC immediately
>
> Microsoft is urging Windows users to immediately install an update
> after security researchers found a serious vulnerability in the
> operating system.
>
> The security flaw, known as PrintNightmare, affects the Windows Print
> Spooler service. Researchers at cybersecurity company Sangfor
> accidentally published a how-to guide for exploiting it.
>
REF:
https://www.bleepingcomputer.com/news/microsoft/microsoft-shares-guidance-on-new-windows-print-spooler-vulnerability/

[excerpt quote=\"
Microsoft shares guidance on new Windows Print Spooler vulnerability

"The attack is not really related to PrintNightmare. As you know, PN can
be executed remotely and this is a local only vulnerability," Baines
confirmed to BleepingComputer.
\" /]

--
Sailfish
CDC Covid19 Trends: https://www.facebook.com/groups/624208354841034
Rare Mozilla Stuff: http://tinyurl.com/z86x3sg

Sailfish graced us with on 7/16/2021 9:30 PM:
> Michael Trew graced us with on 7/12/2021 8:00 PM:
>> Microsoft issues urgent security warning: Update your PC immediately
>>
>> Microsoft is urging Windows users to immediately install an update
>> after security researchers found a serious vulnerability in the
>> operating system.
>>
>> The security flaw, known as PrintNightmare, affects the Windows Print
>> Spooler service. Researchers at cybersecurity company Sangfor
>> accidentally published a how-to guide for exploiting it.
>>
> REF:
> https://www.bleepingcomputer.com/news/microsoft/microsoft-shares-guidance-on-new-windows-print-spooler-vulnerability/
>
> [excerpt quote=\"
> Microsoft shares guidance on new Windows Print Spooler vulnerability
>
> "The attack is not really related to PrintNightmare. As you know, PN can
> be executed remotely and this is a local only vulnerability," Baines
> confirmed to BleepingComputer.
> \" /]
>
REF:
https://www.bleepingcomputer.com/news/microsoft/new-windows-print-spooler-zero-day-exploitable-via-remote-print-servers/

[excerpt quote=\"
Another zero day vulnerability in Windows Print Spooler can give a
threat actor administrative privileges on a Windows machine through a
remote server under the attacker's control and the 'Queue-Specific
Files' feature.
\" /]
Another day, another print spooler zero-day.

--
Sailfish
CDC Covid19 Trends: https://www.facebook.com/groups/624208354841034
Rare Mozilla Stuff: http://tinyurl.com/z86x3sg

On Mon, 19 Jul 2021 22:39:01 -0700, Sailfish wrote:
>
> REF:
> https://www.bleepingcomputer.com/news/microsoft/new-windows-print-spooler-zero-day-exploitable-via-remote-print-servers/
>
> [excerpt quote=\"
> Another zero day vulnerability in Windows Print Spooler can give a
> threat actor administrative privileges on a Windows machine through a
> remote server under the attacker's control and the 'Queue-Specific
> Files' feature.
> \" /]
> Another day, another print spooler zero-day.

Please note: "through a remote server". If your computer is not set
up to be controlled remotely, it seems you have nothing to worry
about.

--
Stan Brown, Tehachapi, California, USA https://BrownMath.com/
https://OakRoadSystems.com/
Shikata ga nai...

Stan Brown graced us with on 7/20/2021 9:02 AM:
> On Mon, 19 Jul 2021 22:39:01 -0700, Sailfish wrote:
>> REF:
>> https://www.bleepingcomputer.com/news/microsoft/new-windows-print-spooler-zero-day-exploitable-via-remote-print-servers/
>>
>> [excerpt quote=\"
>> Another zero day vulnerability in Windows Print Spooler can give a
>> threat actor administrative privileges on a Windows machine through a
>> remote server under the attacker's control and the 'Queue-Specific
>> Files' feature.
>> \" /]
>> Another day, another print spooler zero-day.
>
> Please note: "through a remote server". If your computer is not set
> up to be controlled remotely, it seems you have nothing to worry
> about.
>
True, but for those that are...

--
Sailfish
CDC Covid19 Trends: https://www.facebook.com/groups/624208354841034
Rare Mozilla Stuff: http://tinyurl.com/z86x3sg

Stan Brown <the_stan_brown@fastmail.fm> wrote:
> On Mon, 19 Jul 2021 22:39:01 -0700, Sailfish wrote:
> >
> > REF:
> > https://www.bleepingcomputer.com/news/microsoft/new-windows-print-spooler-zero-day-exploitable-via-remote-print-servers/
> >
> > [excerpt quote=\"
> > Another zero day vulnerability in Windows Print Spooler can give a
> > threat actor administrative privileges on a Windows machine through a
> > remote server under the attacker's control and the 'Queue-Specific
> > Files' feature.
> > \" /]
> > Another day, another print spooler zero-day.
>
> Please note: "through a remote server". If your computer is not set
> up to be controlled remotely, it seems you have nothing to worry
> about.

Note that the text says "remote PRINT servers" (emphasis mine), so
it's not about "your computer [is] not set up to be controlled remotely"
- i.e. inbound -, but about your computer connecting to a print server -
i.e. outbound.

While this scenario is also not common, it can happen when the user
prints to a print server which (s)he trusts, but which has been
compromised without hir knowledge, i.e. at a library, office, etc., etc.

Sailfish graced us with on 7/19/2021 10:39 PM:
> Sailfish graced us with on 7/16/2021 9:30 PM:
>> Michael Trew graced us with on 7/12/2021 8:00 PM:
>>> Microsoft issues urgent security warning: Update your PC immediately
>>>
>>> Microsoft is urging Windows users to immediately install an update
>>> after security researchers found a serious vulnerability in the
>>> operating system.
>>>
>>> The security flaw, known as PrintNightmare, affects the Windows Print
>>> Spooler service. Researchers at cybersecurity company Sangfor
>>> accidentally published a how-to guide for exploiting it.
>>>
>> REF:
>> https://www.bleepingcomputer.com/news/microsoft/microsoft-shares-guidance-on-new-windows-print-spooler-vulnerability/
>>
>> [excerpt quote=\"
>> Microsoft shares guidance on new Windows Print Spooler vulnerability
>>
>> "The attack is not really related to PrintNightmare. As you know, PN
>> can be executed remotely and this is a local only vulnerability,"
>> Baines confirmed to BleepingComputer.
>> \" /]
>>
> REF:
> https://www.bleepingcomputer.com/news/microsoft/new-windows-print-spooler-zero-day-exploitable-via-remote-print-servers/
>
> [excerpt quote=\"
> Another zero day vulnerability in Windows Print Spooler can give a
> threat actor administrative privileges on a Windows machine through a
> remote server under the attacker's control and the 'Queue-Specific
> Files' feature.
> \" /]
> Another day, another print spooler zero-day.
>
PrintNightmare (Gamma variant)

REF:
https://www.bleepingcomputer.com/news/microsoft/remote-print-server-gives-anyone-windows-admin-privileges-on-a-pc/

[excerpt quote=\"
Now anyone can get Windows SYSTEM privileges

Security researcher and Mimikatz creator Benjamin Delpy has been at the
forefront of continuing PrintNightmare research, releasing multiple
bypasses and updates to exploits through specially crafted printer
drivers and by abusing Windows APIs.
\" /]

--
Sailfish
CDC Covid19 Trends: https://www.facebook.com/groups/624208354841034
Rare Mozilla Stuff: http://tinyurl.com/z86x3sg