SB2016071211 - Windows Print Spooler Remote Code Execution Vulnerability

Description

This security bulletin contains information about 1 security vulnerability.

1) Driver validation error in Windows Print Spooler service (CVE-ID: CVE-2016-3238)

A remote attacker with access to local network can execute arbitrary code on the target system.

Windows Print Spooler service fails to properly validate print drivers when installing a printer from the server. A remote attacker with access to local network can perform MitM (man-in-the-middle) attack against workstation or print server and install malicious driver onto vulnerable system

Successful exploitation of this vulnerability may allow a remote attacker to gain complete access to vulnerable system.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-3238