Remediation of CVE-2021-34527 Windows Print Spooler remote code execution vulnerability

A remote code execution vulnerability exists when the Windows® Print Spooler service improperly performs privileged file operations. An attacker who successfully exploits this vulnerability could run arbitrary code with system privileges and perform the following actions:

• Install programs.
• View, change, or delete data.
• Create new accounts with full user rights.

For more information, see the Microsoft complete guidance for CVE-2021-34527.

Rackspace recommended remediation

For customers who use Rackspace Managed Patching, the required update is available with the release of July 2021 patches.

Out-of-band remediation

Customers who want to remediate this before the July 2021 patching window should use the following steps:

Install the applicable out-of-band update in CVE-2021-34527. These updates require a reboot.

After installing the update, perform the following steps:

1. Open the Registry Editor for the server on which you want to install the update by clicking Start Menu > Run. Type regedit and click OK.

2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint
   and look for the following registry keys:

   • NoWarningNoElevationOnInstall
   • NoWarningNoElevationOnUpdate

3. Set the the registry keys to 0 to disable Point and Print. If the registry keys are missing, the features are disabled. Ensure that disabling this feature doesn't affect necessary business operations on the server.

Note: To enable Point and Print in the future, set the registry keys to 1.

After patching, Microsoft also recommends that you complete the steps in KB5005010: Restricting installation of new printer drivers after applying the July 6, 2021 updates.

Workarounds

If you can't install patches at this time, review the following workarounds to protect servers until you can install the patches:

Option 1

Disable the Print Spooler service on servers that are not serving in any printing capacity by using the following commands:

Stop-Service -Name Spooler -Force

Set-Service -Name Spooler -StartupType Disabled

Option 2

Disable inbound remote printing through Group Policy by using the following steps:

1. In the Group Policy Editor, navigate to Computer Configuration > Administrative Templates > Printers.

2. Disable the Allow Print Spooler to accept client connections policy to block remote attacks.

3. Restart the Print Spooler service.

If you need more information or further assistance regarding this vulnerability, open a Support ticket in the Customer Portal, or contact your Rackspace Support team.