Remote code execution in Print Spooler service in Microsoft Windows

Published: 2010-09-14 19:11:43 | Updated: 2017-01-04
Severity Critical
Patch available YES
Number of vulnerabilities 1
CVE ID CVE-2010-2729
CVSSv3 9.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C]
CWE ID CWE-284
Exploitation vector Network
Public exploit This vulnerability is being exploited in the wild.
Vulnerable software Windows
Windows Server
Vulnerable software versions Windows XP
Windows Vista
Windows 7
Windows Server 2003
Windows Server 2008
Windows Server 2008 R2
Vendor URL Microsoft

Security Advisory

1) Improper access control

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to Windows Print Spooler service does not correctly restricts access permissions to create files for anonymous users. A remote attacker can send specially crafted RPC request to vulnerable service and upload malicious file to arbitrary location on the system.

This is a remote code execution vulnerability on Windows XP, since the guest account is enabled by default. On other operating systems this is a privilege escalation vulnerability, as only authenticated users have access to Print Spooler shares.

Successful exploitation of the vulnerability may result in remote code execution.

Note: this vulnerability is being actively exploited.

Remediation

Install patch from Microsoft website.

External links

https://technet.microsoft.com/en-us/library/security/ms10-061.aspx
https://securelist.com/blog/incidents/29747/myrtus-and-guava-episode-ms10-061/
https://www.symantec.com/connect/blogs/stuxnet-using-three-additional-zero-day-vulnerabilities

Back to List