PT-2021-4040 · Microsoft · Windows Print Spooler+1

Benjamin Delpy + 1 · Published 2021-08-10 · Updated 2023-12-28 · CVE-2021-36958

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Print Spooler (affected versions not specified)

Description A remote code execution issue exists due to the Windows Print Spooler service improperly performing privileged file operations. This allows an attacker to run arbitrary code with SYSTEM privileges, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. The vulnerability can be exploited by sending a specially crafted request, potentially allowing attackers to execute arbitrary code and affect the system.

Recommendations To prevent exploitation, stop and disable the Print Spooler service. As a temporary workaround, consider disabling the Print Spooler service to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2021-04567

CVE-2021-36958

Affected Products

Windows

Windows Print Spooler

References · 16

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36958 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36958 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/686780 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36958 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04567 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-36958 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/668488 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2021-36958 · Vendor Advisory
• https://t.me/true_secator/2001 · Telegram Post
• https://kb.cert.org/vuls/id/131152 · Note
• https://t.me/thehackernews/1435 · Telegram Post
• https://t.me/cibsecurity/27267 · Telegram Post
• https://t.me/true_secator/1997 · Telegram Post
• https://t.me/cybersecuritytechnologies/4203 · Telegram Post
• https://t.me/sysadm_in_channel/3283 · Telegram Post