SB2016071307 - Two vulnerabilities in Windows Print Spooler service

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Privilege escalation in Windows Print Spooler service (CVE-ID: CVE-2016-3239)

The vulnerability allows a local user to elevate privileges on vulnerable system.

The vulnerability exists due to Windows Print Spooler service allows arbitrary writing to the file system to unprivileged users. A local user can overwrite arbitrary files on the system.

Successful exploitation of this vulnerability may allow a local user to execute arbitrary code on the target system with elevated privileges.

2) Driver validation error in Windows Print Spooler service (CVE-ID: CVE-2016-3238)

A remote attacker with access to local network can execute arbitrary code on the target system.

Windows Print Spooler service fails to properly validate print drivers when installing a printer from the server. A remote attacker with access to local network can perform MitM (man-in-the-middle) attack against workstation or print server and install malicious driver onto vulnerable system

Successful exploitation of this vulnerability may allow a remote attacker to gain complete access to vulnerable system.

Remediation

Install update from vendor's website.

References

• https://technet.microsoft.com/en-us/library/security/MS16-087