CERT-In Vulnerability Note CIVN-2006-124
Microsoft Windows Print Spooler Denial of Service Vulnerability

Original Issue Date: December 05, 2006

Severity Rating: Medium

Systems Affected

• Microsoft Windows 2000 Advanced Server
• Microsoft Windows 2000 Professional
• Microsoft Windows 2000 Server

Overview

A denial of service vulnerability has been reported in Microsoft Windows Print Spooler Service which could be exploited by an attacker to cause sytem crash.

Description

The vulnerability is caused due to an error while handling "RpcGetPrinterData()" RPC requests within the Print Spooler service (spoolsv.exe).

The attacker could exploit this vulnerability by creating and sending specially crafted packets to vulnerable system and could cause denial of service by consuming all available memory.

Workaround

Restrict access to service or disable the Print Spooler service if not required.

References

FrSIRT
http://www.frsirt.com/english/advisories/2006/4827

Secunia
http://secunia.com/advisories/23196/

CVE Name
CVE-2006-6296

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Communications and Information Technology
Electronics Niketan
6, C.G.O. Complex
New Delhi-110 003