Microsoft released an emergency patch and stated that the vulnerability is being actively exploited in the wild. All the news articles describing the RCE are implying that any internet-connected computer running Windows is at risk. This can't possibly be true, can it? My question is: does the PrintNightmare RCE (CVE-2021-34527) require a privileged position, such as a Windows user account, or at least local network access? I'm assuming regular consumer routers do not expose random ports to the internet.
-
2Although I'm not 100% sure, it looks like you need to be an AD authenticated user to exploit it. In any case, if your print spooler service is not exposed to the internet, the attacker would, at minimum, need access to your network to exploit it.– nobodyJul 8, 2021 at 12:24
-
I also wonder why Windows always has to have open ports by default (I'm sure this isn't the first time there's some "remote" RCE). Plus, wouldn't a firewall (or Windows Firewall itself) just block every incoming connection? There's something wrong with having open ports by default, when normally they are not needed.– reedJul 8, 2021 at 15:29
-
Stan Hegt tweeted a flowchart for determining if a computer is vulnerable to RCE: twitter.com/StanHacked/status/1410929974358515719, and byt3bl33d3r published a scanner: github.com/byt3bl33d3r/ItWasAllADream– Gordon DavissonJul 25, 2021 at 3:53
Add a comment
|
2 Answers
All the news articles describing the RCE are implying that any internet-connected computer running Windows is at risk.
First, what you have stated here is not true.
The article that you yourself linked to does not describe the vulnerability in this way.
The US-CERT article on the vulnerability also does not describe the vulnerability in this way.
My question is: does the PrintNightmare RCE (CVE-2021-34527) require a privileged position, such as a Windows user account, or at least local network access? I'm assuming regular consumer routers do not expose random ports to the internet.
The vulnerability may exist in every unpatched Windows OS, but in order for it to be exploited the computer need to be accessible to the attacker from the network.
So, if your home Windows 10 computer is behind a home router, then that computer is not accessible from the big bad Internet in most cases (unless you have enabled port forwarding).
You are correct that most home routers do not, by default, have port forwarding enabled.
-
Why is it not a "news article"? It seems to be reasonably described as an "article" and it contains "news"...– hftJul 24, 2021 at 22:18
-
This does affect all versions of Windows, from my understanding. As a workaround, you can stop and disable the print spooler service - until you're comfortable with a patch.
-
This answer is incorrect, because the vulnerability does not affect all versions of Windows (in particular, the recently patched versions should not be at risk). Furthermore, this answer does not answer the question, because it doesn't address what conditions need to be present in addition to having a vulnerable Windows version connected to the internet, e.g. does the attacker require a Windows account or a privileged network position. Jul 24, 2021 at 23:39