How to Determine Print Drivers Being Used in Blueprint

Shared Print Queue(s) and Pharos MobilePrint

On the print server, launch the Print Management (printmanagement.msc) application. Expand the tree in the left side menu to locate the printers that are present on the local print server. View the Driver Name and Driver Version used for all print queues.   

Mitigation

Update drivers utilized by shared print queues as required. Client workstations connected to shared print queues will inherit the new driver automatically upon next usage.

MobilePrint’s driver mapping will need to be reconfigured accordingly. Please refer to the “MobilePrint X.X.X Installation and Configuration Guide for Blueprint” for further information. 

Reference: MobilePrint Documentation 

Pharos Blueprint Print Scout “serverless” print queue 

This feature of the Pharos Blueprint Print Scout is enabled when the Print Scout has been installed onto client workstation with the /serverlessurl argument. The print queue created by this feature will have a default name of “Pharos Secure Printer” and will use the HP Universal Print Driver version that was included within the Print Scout. Both the queue name and driver may have been customized at installation, therefore, it is conceivable that the print queue’s driver may not be subject to the vulnerability disclosed in HP’s Universal Print Driver. 

Note – “serverless” print queues are present only on client workstations and will never be present on print servers with Pharos Blueprint Enterprise. 

How to check if a workstation contains a Blueprint Print Scout “serverless” print queue 

From the Start Menu, launch the Settings application. Navigate to Bluetooth & Devices > Printers & Scanners. Select the “Pharos Secure Printer” print queue. (The actual name may vary if it has been customized.) Click the Printer Properties button to display the printer properties. 

Select the Ports tab within the printer properties window that appears. A “serverless” secure print queue will be utilizing the Pharos Secure Delivery Port (SecureDeliveryPort). 

Select the General tab within the printer properties window. Observe the print driver being utilized by the print queue. If the driver listed is HP’s Universal Print Driver v7.3.0.25919 or earlier, continue to mitigation. 

Mitigation

Pharos will be publishing an updated version of Pharos Blueprint Print Scout (7.38.4.100) that will include an updated HP Universal Print Driver (7.3.0.25919). Deploy the updated Pharos Blueprint Print Scout to all client workstations impacted by the HP Universal Print Driver vulnerability.  

Pharos Blueprint Print Scout IPP print queue 

This feature of the Pharos Blueprint Print Scout is enabled when the Print Scout has been installed onto client workstation with the /ippserver argument. The print queue created by this feature will have a default name of “Secure Print” and will use the Pharos IPP Print Driver version that was included within the Print Scout. The print queue name is customizable, therefore, the print queue’s name may not match the documentation provided below.  

Note: The print queue created by this feature utilizes the Blueprint IPP Print Driver and is not subject to the vulnerability disclosed in HP’s Universal Print Driver.

How to check if a workstation contains a Blueprint Print Scout IPP print queue

From the Start Menu, launch the Settings application. Navigate to Bluetooth & Devices > Printers & Scanners. Select the “Secure Print” print queue. (The actual name may vary if it has been customized.) Click the Printer Properties button to display the printer properties. 

The “Secure Print” print queue utilizes the Pharos IPP Secure Print Driver, which is not subject to the vulnerability disclosed in HP’s Universal Print Driver. No further action is required. 

Mitigation

Not applicable.  The Pharos IPP Secure Print Driver is not subject to the vulnerability disclosed in HP’s Universal Print Driver.