PT-2009-2903 · Microsoft · Windows Print Spooler Service+2

Jun Mao · Published 2009-06-10 · Updated 2018-10-12 · CVE-2009-0228

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows 2000 SP4

Description A remote code execution issue exists in the Windows Print Spooler Service, allowing a remote, unauthenticated attacker to execute arbitrary code on an affected system. This could enable the attacker to take complete control of the system, install programs, view, change, or delete data, or create new accounts. The issue is related to a stack-based buffer overflow in the EnumeratePrintShares function in win32spl.dll, which can be triggered by a crafted ShareName in a response to an RPC request.

Recommendations For Microsoft Windows 2000 SP4, apply the necessary patch to fix the buffer overflow in the Print Spooler Service to prevent remote code execution. As a temporary workaround, consider restricting access to the Windows Print Spooler Service until a patch is available.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2009-0228

Affected Products

Windows

Windows 2000

Windows Print Spooler Service

References · 13

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-022 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0228 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-0228 · Security Note
• http://securitytracker.com/id?1022352 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2009/MS09-022 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6317 · Note
• http://vupen.com/english/advisories/2009/1541 · Note
• http://support.avaya.com/elmodocs2/security/ASA-2009-217.htm · Note
• http://osvdb.org/54932 · Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=806 · Note
• http://secunia.com/advisories/35365 · Note
• http://securityfocus.com/bid/35206 · Note
• http://us-cert.gov/cas/techalerts/TA09-160A.html · Note