Malformed Spooler Request Vulnerability

A vulnerability exists that could allow a user to cause the print spooler service to crash, or to run arbitrary code on a Windows NT machine.

Issue

Certain APIs in the Windows NT 4.0 print spooler subsystem have unchecked buffers. If an affected API were provided with random data as input, it could crash the print spooler service. If it were provided with a specially-malformed argument, it could be used to run arbitrary code on the server via a classic buffer overrun attack. The majority of the affected APIs require the caller to be a member of the Power Users or Administrators group; however, at least one is callable by normal users. None of the calls could be made by anonymous users, but the calls could be made remotely.

A second vulnerability exists because incorrect permissions would allow a normal user to specify his or her own code as a print provider. Because print providers run in a local System context, this would allow the user to gain additional privileges on the local machine. This vulnerability could not be exploited remotely.

Affected Products

• Windows NT Server, Enterprise, Terminal Server and Workstation 4.0

Download

Patch: http://download.microsoft.com/download/winntsrv40/Patch/Spooler-fix/NT4/EN-US/Q243649.exe

Further Details

Source: Microsoft Corporation

Reference: Microsoft Corporation

Updated: November 4, 1999

>> Recommended Download - secure your PC from spyware, adware and malware now with Spyware Doctor <<