News

Print Spooler Bug Fixed by Microsoft

Microsoft Corp. released a patch today that eliminates a security vulnerability in Windows NT 4.0. The vulnerability could allow a user to cause the print spooler to crash, or to run arbitrary code on an NT machine. The patch also eliminates a vulnerability that could allow a user to substitute code of their choosing for a print provider that runs in a privileged state.

Certain APIs in the Windows NT 4.0 print spooler subsystem have unchecked buffers, and if an affected API were provided with random data, it could crash the print spooler service. If it were provided with a specially-malformed argument, it could be used to run arbitrary code on the server via a classic buffer overrun attack. The majority of the APIs require the caller to be a member of the Power Users or Administrators group; however, at least one is callable by normal users. None of the calls could be made by anonymous users, but the calls could be made remotely.

A second vulnerability exists because incorrect permissions would allow a normal user to specify his or her own code as a print provider. Because print providers run in a local System context, this would allow the user to gain additional privileges on the local machine. This vulnerability could not be exploited remotely.

Affected are Windows NT 4.0 Workstation, Server, Server Enterprise Edition, and Terminal Server Edition. The patch is available for x86 at http://download.microsoft.com/download/winntsrv40/Patch/Spooler-fix/NT4/EN-US/Q243649.exe and for Alpha at http://download.microsoft.com/download/winntsrv40/Patch/Spooler-fix/ALPHA/EN-US/Q243649.exe.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

  • The 2022 Microsoft Product Roadmap

    Microsoft has a lot in the docket for 2022, including new products like SQL Server 2022, Exchange Subscription Edition and Visual Studio 2022 for Mac.

  • Report: IT Budgets To Increase Despite Slowdown in Hiring

    A newly published annual report found that 51 percent of IT departments are planning to increase their IT spending next year, even in the face of a possible recession.

  • Microsoft Bolsters 'Employee Experience' with Latest Viva Apps

    Microsoft's Viva suite is getting new apps and enhancements, according to an announcement made on Thursday.

  • Microsoft Releases Windows 11 Version 22H2

    The latest version of Windows 11, known as "version 22H2," officially has been released.