PT-2009-2904 · Microsoft · Windows Vista+6

Published 2009-06-10 · Updated 2023-12-07 · CVE-2009-0229

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the patchday that contains the fix for the issue, including: Windows 2000 SP4 Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista Gold, SP1, and SP2 Windows Server 2008 SP2

Description A local, authenticated information disclosure issue exists in the Windows Printing Service, allowing users to read arbitrary files via a crafted separator page. This could enable a user to read or print any file on the system, even without administrative access. The issue cannot be exploited remotely or by anonymous users.

Recommendations For Windows 2000 SP4, apply the patch from the patchday that contains the fix for the issue. For Windows XP SP2 and SP3, apply the patch from the patchday that contains the fix for the issue. For Windows Server 2003 SP2, apply the patch from the patchday that contains the fix for the issue. For Windows Vista Gold, SP1, and SP2, apply the patch from the patchday that contains the fix for the issue. For Windows Server 2008 SP2, apply the patch from the patchday that contains the fix for the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2009-0229

Affected Products

Windows

Windows 2000

Windows Printing Service

Windows Server 2003

Windows Server 2008

Windows Vista

Windows Xp

References · 13

• 🔥 https://github.com/zveriu/CVE-2009-0229-PoC · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-0229 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0229 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-022 · Vendor Advisory
• http://securitytracker.com/id?1022352 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2009/MS09-022 · Note
• http://vupen.com/english/advisories/2009/1541 · Note
• http://support.avaya.com/elmodocs2/security/ASA-2009-217.htm · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5815 · Note
• http://securityfocus.com/bid/35208 · Note
• http://secunia.com/advisories/35365 · Note
• http://osvdb.org/54933 · Note
• http://us-cert.gov/cas/techalerts/TA09-160A.html · Note