Daily Shaarli

Looking at our patch Tuesday list, I looked a bit closer at CE-2020-1048 (Print Spooler Privilege Escalation) and Microsoft's ratings for that one. Microsoft rated this as:

Disclosed: NO
Exploited: NO
Exploitability (old and new versions)

Unfortunately, this vulnerabiltiy was actually disclosed to Microsoft by the research community (see below), so the code to exploit it absolutely does exist and was disclosed, and a full write-up was posted as soon as the patch came out:
https://windows-internals.com/printdemon-cve-2020-1048/

Long story short, on an unpatched system, you can plant a persistent backdoor on a target host with this one-liner in PowerShell:

  Add-PrinterPort -Name c:\windows\system32\ualapi.dll

Then "print" an MZ file (DOS excecutable) to that printer to light it up.

As noted, this backdoor is persistent, and will remain in place even after you apply the patch!

Moral of the story? For me, there are a couple of them:

• Don't put too much stock in risk ratings assigned to patches. "Lows" and "Mediums" can bite you just as badly as vulnerabilities rated as "High". This goes for patches as well as scan results or pentest results. If your policy is to patch only Severe and High rated issues, you'll pay for that eventually.
• Also, it's a good thing that more vendors are going to monolithic patching. If you apply the current patch set from Microsoft, you get them all - there's no more "cherry picking" allowed!

hstspreload