Microsoft has released a new advisory on the Elevation of Privilege vulnerability affecting Windows print Spooler component on last Thursday (15th of July) with the CVE-2021-34481.
Microsoft stated “An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights“.
However, Microsoft has confirmed that the attacker must have the ability to execute code on the victim machine to take advantage of this vulnerability.
Workaround:
“The workaround for this vulnerability is stopping and disabling the Print Spooler service” which is as per the Microsoft. They also released below list of steps which can be executed as a workaround.
Determine if the Print Spooler service is running
Run the following in Windows PowerShell:
Get-Service -Name Spooler
If the Print Spooler is running or if the service is not disabled, follow these steps:
Stop and disable the Print Spooler service
If stopping and disabling the Print Spooler service is appropriate for your environment, run the following in Windows PowerShell:
Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled
Impact of workaround Stopping and disabling the Print Spooler service disables the ability to print both locally and remotely.
Source: Microsoft
–-For more Cyber security news in crisp content . Please follow our site via twitter handle @cyberworkx1
CyberWorkx 