Improper access control in Microsoft Windows and Windows Server - CVE-2010-2729

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to Windows Print Spooler service does not correctly restricts access permissions to create files for anonymous users. A remote attacker can send specially crafted RPC request to vulnerable service and upload malicious file to arbitrary location on the system.

This is a remote code execution vulnerability on Windows XP, since the guest account is enabled by default. On other operating systems this is a privilege escalation vulnerability, as only authenticated users have access to Print Spooler shares.

Successful exploitation of the vulnerability may result in remote code execution.

Note: this vulnerability is being actively exploited.

Affected software

How to mitigate CVE-2010-2729

Links to Public Exploits and PoC-codes

• Exploit #712 - Microsoft Windows - Print Spooler Service Impersonation (MS10-061) (Metasploit) (March 18, 2020)
• Exploit #1594 - MS10-061 Microsoft Print Spooler Service Impersonation Vulnerability (March 18, 2020)

External References

• https://technet.microsoft.com/en-us/library/security/ms10-061.aspx
• https://securelist.com/blog/incidents/29747/myrtus-and-guava-episode-ms10-061/
• https://www.symantec.com/connect/blogs/stuxnet-using-three-additional-zero-day-vulnerabilities

Related Security Bulletins

• Remote code execution in Print Spooler service in Microsoft Windows