Remote code execution in Print Spooler service in Microsoft Windows



| Updated: 2017-01-04
Risk Critical
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2010-2729
CWE-ID CWE-284
Exploitation vector Network
Public exploit This vulnerability is being exploited in the wild.
Vulnerable software
 Windows
Operating systems & Components / Operating system

Windows Server
Operating systems & Components / Operating system

Vendor Microsoft

Security Bulletin

This security bulletin contains one critical risk vulnerability.

1) Improper access control

EUVDB-ID: #VU3475

Risk: Critical

CVSSv3.1: 9.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C]

CVE-ID: CVE-2010-2729

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to Windows Print Spooler service does not correctly restricts access permissions to create files for anonymous users. A remote attacker can send specially crafted RPC request to vulnerable service and upload malicious file to arbitrary location on the system.

This is a remote code execution vulnerability on Windows XP, since the guest account is enabled by default. On other operating systems this is a privilege escalation vulnerability, as only authenticated users have access to Print Spooler shares.

Successful exploitation of the vulnerability may result in remote code execution.

Note: this vulnerability is being actively exploited.

Mitigation

Install patch from Microsoft website.

Vulnerable software versions

Windows: XP - 7

Windows Server: 2003 - 2008

CPE2.3 External links

http://technet.microsoft.com/en-us/library/security/ms10-061.aspx
http://securelist.com/blog/incidents/29747/myrtus-and-guava-episode-ms10-061/
http://www.symantec.com/connect/blogs/stuxnet-using-three-additional-zero-day-vulnerabilities


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.



###SIDEBAR###