Windows Print Spooler Exploit
Our Valued Clients;
It has been recently announced in the press that a Microsoft Windows Print Spooler Exploit has been uncovered. In the most simplistic terms a regular users account can send commands to a windows print server that can execute remote code to compromise the machine. There is currently no patch to fix it but there are some steps that can be taken to reduce the possibly of an exploit taking hold.
The only current work around from Microsoft is to turn off all print spooling which will affect any non-locally attached printers (i.e. shared through a workstation or server). This can have a large impact on users wo do a lot of printing. Therefore any server that has print spooling enabled, but does not share its printers should be stopped and disabled.
For any servers that do share printers, there is a temporary change that can be made that should deny any requests to add/remove/change printers or settings. This should still allow remote printing but as stated no alterations can be made. This may cause some printing issues but is the only alternatives to the first item listed above to allow printing to continue
Once the official Microsoft patch is released we can reverse either of these changes to allow full functionality to return. As with any exploit, please caution all users to be extra vigilant in checking emails or downloading programs that may contain code that could exploit this vulnerability.
Sincerely,
Ridge Support Technologies
