August 12, 2021

Microsoft has released an advisory for another zero-day Windows print spooler vulnerability called CVE-2021-36958 that allows local attackers to gain SYSTEM privileges on a computer.

This vulnerability is part of a class of bugs known as “PrintNightmare” that misuse configuration settings for the Windows print spooler, printer drivers, and Windows Point and Print function.

Microsoft released security updates in both July and August to fix several vulnerabilities in PrintNightmare.

A zero-day vulnerability in the Windows Print Spooler, identified by security expert Benjamin Delpy as CVE-2021-36958, allows threat actors to quickly gain SYSTEM privileges by simply connecting to a remote print server.

While Microsoft’s recent security updates have changed the installation procedures for printer drivers to require admin privileges, users do not need to enter admin privileges to connect to a printer if that driver is already installed.

If the driver is on a client and thus does not need to be installed, the connection to a remote printer will still execute the CopyFile directive for non-administrators.

This vulnerability allows Delpy’s DLL to be copied to the client and executed to open a SYSTEM-level command prompt.

For more information, read the original story in BleepingComputer.