PT-2021-3629 · Microsoft · Windows Print Spooler+1

Jacob Baines · Published 2021-07-07 · Updated 2024-01-31 · CVE-2021-34481

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows Print Spooler versions prior to the version with the security update released by Microsoft

Description The issue is related to insufficient access restrictions in the Windows Print Spooler service, allowing a remote attacker to execute arbitrary code with SYSTEM privileges by loading a malicious DLL library. This could enable the attacker to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Windows Print Spooler versions prior to the version with the security update released by Microsoft: Install the security updates provided by Microsoft immediately to address this issue. Additionally, consider changing the Point and Print default behavior as described in KB5005652. As a temporary workaround, consider restricting access to the Windows Print Spooler service until the security update is applied.

Fix

RCE

Improper Privilege Management

Weakness Enumeration

CWE-269

CWE-264

Related Identifiers

BDU:2021-03828

CVE-2021-34481

Affected Products

Windows

Windows Print Spooler

References · 16

• https://bdu.fstec.ru/vul/2021-03828 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34481 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-34481 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34481 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2021-34481 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-34481 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34481 · Vendor Advisory
• https://t.me/cvenotify/18908 · Telegram Post
• https://t.me/ckure/8588 · Telegram Post
• https://t.me/defcon_news/81189 · Telegram Post
• https://twitter.com/Junior_Baines/status/1752837051987177978 · Twitter Post
• https://t.me/ckure/8587 · Telegram Post
• https://t.me/thehackernews/1371 · Telegram Post
• https://t.me/cvenotify/48030 · Telegram Post
• https://t.me/cvenotify/17774 · Telegram Post