Signature Detail

MS-RPC: SPOOLSS Overflow (3)

This signature detects attempts to exploit a known vulnerability in the Windows 2000 print spooler. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the server.

Extended Description

Microsoft Windows is prone to a remote stack-based buffer-overflow vulnerability that affects the Windows Print Spooler. Exploiting this vulnerability allows attackers to execute arbitrary code with system-level privileges. Failed exploit attempts will likely cause denial-of-service conditions.

Affected Products

• Avaya Messaging Application Server MM 1.1
• Avaya Messaging Application Server MM 2.0
• Avaya Messaging Application Server MM 3.0
• Avaya Messaging Application Server MM 3.1
• Avaya Messaging Application Server
• Microsoft Windows 2000 Advanced Server SP4
• Microsoft Windows 2000 Datacenter Server SP4
• Microsoft Windows 2000 Professional SP4
• Microsoft Windows 2000 Server SP4
• Nortel Networks Communication Control Toolkit
• Nortel Networks Contact Center Administration CCMA 6.0
• Nortel Networks Contact Center Manager Server
• Nortel Networks Contact Center Multimedia
• Nortel Networks Contact Center - TAPI Server
• Nortel Networks LinkPlexer 6.0
• Nortel Networks Media Processing Server
• Nortel Networks Media Processing Svr 100
• Nortel Networks Media Processing Svr 1000 Rel 3.0
• Nortel Networks Media Processing Svr 500 Rel 3.0
• Nortel Networks Self-Service - CCSS7
• Nortel Networks Self-Service CCXML
• Nortel Networks Self-Service Media Processing Server
• Nortel Networks Self-Service Peri Application
• Nortel Networks Self-Service - Peri Application Rel 3.0
• Nortel Networks Self-Service Peri Workstation
• Nortel Networks Self-Service Speech Server
• Nortel Networks Self Service VoiceXML
• Nortel Networks Self-Service WVADS
• Nortel Networks Symposium Express Call Center (SECC)
• Nortel Networks Symposium Network Control Center (NCC)
• Nortel Networks Symposium TAPI Service Provider

References

• BugTraq: 35206
• CVE: CVE-2009-0228