SMB: Windows Print Spooler Authentication Bypass

This signature detects attempts to exploit a known vulnerability against Windows Print Spooler. A successful attack allows attackers to bypass security measures and execute arbitrary remote code.

Extended Description

Microsoft Windows is prone to a remote code-execution vulnerability that affects the Print Spooler Service. A remote attacker can exploit this issue to execute code with SYSTEM-level privileges. Local attackers able to submit print jobs can exploit this issue to gain elevated privileges. NOTE: To exploit this issue, an attacker must have permissions to submit print jobs on the vulnerable system. Guest access to shared print services is enabled by default on Windows XP; later systems will require the attacker to authenticate to the server, or require the server to be configured to allow anonymous access.

Affected Products

Avaya messaging_application_server,Microsoft windows_server_2008_for_itanium-based_systems

References

BugTraq: 43073

CVE: CVE-2010-2729

URL: http://www.microsoft.com/technet/security/bulletin/MS10-061.mspx

Short Name

SMB:EXPLOIT:PRINT-SPOOL-BYPASS

Severity

Critical

Recommended

False

Recommended Action

Drop

SMB: Windows Print Spooler Authentication Bypass

Extended Description

Affected Products

References

Found a potential security threat?