News Microsoft Patches A Major Exploit From Windows' Printer Service

[Admin]

Yesterday Microsoft patched a major printer exploit called "PrintNightmare", allowing hackers to execute malicious code remotely from the Window's Print Spooler service.

Microsoft Patches A Major Exploit From Windows' Printer Service : Read more

 

[Palorim12]

this update broke all our Zebra label printers in my job. Have had to go to every PC in the company and uninstall the update and pause updates.

 

[USAFRet]

this update broke all our Zebra label printers in my job. Have had to go to every PC in the company and uninstall the update and pause updates.

Having rolled back from this patch, what is your near and long term concept for mitigating the problem this patch fixes?

 

[hotaru.hino]

this update broke all our Zebra label printers in my job. Have had to go to every PC in the company and uninstall the update and pause updates.

And did you ask Zebra if there's a fix for this coming?

Because considering there are public implementations to exploit this vulnerability, the longer you go without updating the more at risk you put your company at.

 

[Eximo]

Depends if the machines running the printers are internet facing, I suppose.

 

[vern72]

So the printer is on fire!

 

[Palorim12]

Having rolled back from this patch, what is your near and long term concept for mitigating the problem this patch fixes?

At the moment no idea. Spent all of Wednesday with the head of our IT department trying stuff on one of the affected computers, and one of our other guys contacted Microsoft and they said they are aware of the issue with Type 3 printers like the Zebra and to just uninstall the update and pause updates. After 7 hours, my boss told me he gave up and to just uninstall the update and we'll wait and see.

And did you ask Zebra if there's a fix for this coming?

Because considering there are public implementations to exploit this vulnerability, the longer you go without updating the more at risk you put your company at.

These printers are local printers, luckily, but the systems themselves are connected to the internet. there's a reddit page where someone posted that Zebra is aware of the issue, but nothing else yet. View: https://www.reddit.com/r/sysadmin/comments/oflbny/windows_printnightmare_update_kb5004945_is/


"The July 6 Windows “KB5004945” update is affecting multiple printer brands and impacting our call center wait times. Microsoft plans to release an update in the next 1–2 business days. Please click here for more information on how to address this issue."
https://supportcommunity.zebra.com/...ctic_detail=OT_July+Windows+Update_TW_NA_None

Microsoft's resolution is Known Issue Rollback, but my boss says its not for KB5004945, despite Microsoft listing KB5004945.

 

[USAFRet]

OK.
Don't forget to Unpause the updates when this is fixed.

 

[Eximo]

Zebra printers, and other printers, were the bane of my existence at my old job. IT didn't support printers, it was outsourced, so all the non-standard printers were always causing issues because there was no information sharing. I never understood why they didn't just create a small group to handle it.

One time we put in an comprehensive asset management system. It had a SMTP function where it would query devices on the network for their information.

Apparently some of the printers took those messages as input commands and made all sorts of weird adjustments. Still not sure if that was the result of poor programming, or just a mix of outdated printers and newer SMTP messages (or somebody did something stupid, like re-purposing a set of commands)

 

[Palorim12]

Looks like Microsoft released KB5004237 yesterday which "updates an issue that might make printing to certain printers difficult. This issue affects various brands and models, but primarily receipt or label printers that connect using a USB port." My zebra printers are working now after installing this update.