Signature Detail

MS-RPC: SPOOLSS Buffer Overflow (1)

This signature detects attempts to exploit a known vulnerability against Microsoft Windows SPOOLSS service. Because of improper bounds checking in the Print Spooler service, an attacker can trigger a buffer overflow in the affected system. This action can lead to arbitrary code execution at System level privileges.

Extended Description

Buffer overflow in the Print Spooler service (Spoolsv.exe) for Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code via a malicious message.

Affected Products

• Microsoft windows_2000 (sp4:)
• Microsoft windows_2000 (sp4)
• Microsoft windows_2000 (sp4::fr)
• Microsoft windows_2003_server r2
• Microsoft windows_xp (sp1)
• Microsoft windows_xp (sp1:tablet_pc)
• Microsoft windows_xp (sp2)
• Microsoft windows_xp (sp2:tablet_pc)

References

• BugTraq: 14514
• CVE: CVE-2005-1984
• URL: http://www.microsoft.com/technet/Security/bulletin/ms05-043.mspx
• URL: http://oval.mitre.org/oval/definitions/data/oval100077.html
• URL: http://www.us-cert.gov/cas/techalerts/TA05-221A.html