Windows Print Spooler Remote Code Execution Vulnerability

CVE-2016-3238
Security Vulnerability

Released: Jul 12, 2016

Last updated: Sep 12, 2017

Assigning CNA
Microsoft
CVE.org link
CVE-2016-3238

Executive Summary

A remote code execution vulnerability exists when the Windows Print Spooler service does not properly validate print drivers while installing a printer from servers. An attacker who successfully exploited this vulnerability could use it to execute arbitrary code and take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

To exploit this vulnerability, an attacker must be able to execute a man-in-the-middle (MiTM) attack on a workstation or print server or set up a rogue print server on a target network.

The update addresses the vulnerability by issuing a warning to users who attempt to install untrusted printer drivers.

Exploitability

The following table provides an exploitability assessment for this vulnerability at the time of original publication.

Publicly disclosed
No
Exploited
No
Exploitability assessment
Exploitation Less Likely

Mitigations

The following mitigating factors may be helpful in your situation. Depending on the operating system you are running and its configuration, you may be able to change Point and Print Restrictions policies to enable users to print only to specific print servers that you trust. For information about specific operating systems and configuration options, see: Microsoft Knowledge Base Article 2307161 Microsoft Knowledge Base Article 319939

Acknowledgements

  • Nicolas Beauchesne of Vectra Networks
Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure. See Acknowledgements for more information.

Security Updates

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle.

Release date Descending
All results loaded
Loaded all 27 rows

Disclaimer

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions

How satisfied are you with the MSRC Security Update Guide?