PrintNightmare (CVE-2021-1675 & CVE-2021-34527) Zero Day protection in Data Center Security and Endpoint Protection
Article ID: 219153
Updated On:
Products
Issue/Introduction
CVE-2021-1675 & CVE-2021-34527 were released to describe a Zero Day threat to a wide range of Windows systems. Data Center Security and Endpoint Protection can help protect against this on systems that cannot be currently patched.
Environment
Symantec Data Center Security Server
Symantec Data Center Security Server Advanced
Endpoint Protection 14.x
Cause
Microsoft has released an advisory on an LPE (Local Privilege Escalation) and RCE (Remote Code Execution) vulnerability (CVE-2021-1675). The flaw (aka PrintNightmare) impacts the Windows Print Spooler service and could be exploited to compromise Windows systems. Vulnerabilities like this are most likely to be used in targeted attacks. Microsoft’s Patch Tuesday released on June 8th addressed the vulnerability. Security researchers publicly disclosed information regarding successful exploitation of the vulnerability. Different researchers publicized further details and posted proof of concept code which was removed shortly thereafter.
Resolution
Data Center Security (DCS) provides zero day protection against the Windows Print Spooler Remote Code Execution vulnerability on Domain Controllers and Servers with default hardening policies.
Endpoint Protection provides zero day protection using file-based definitions starting with Rapid Release 20210702.021 and later.
In addition
We have introduced some heuristic detection. We have changed the signature in smarthash , Hachtool -> Exp.CVE-2021-34527(VID: dac6).
V8 signature has been also turned on to catch the sample!
Additional Information
https://www.broadcom.com/support/security-center/protection-bulletin#1211267422796
Feedback
