--------------------------------------
A] buffer-overflow in control filename
--------------------------------------
wincomlpd is affected by a buffer-overflow vulnerability exploitable
during the building of an error string caused by the impossibility of
creating the file specified by the client.
The queues of remote printers are not affected by the problem.
The administration service which runs on port 13500 is used by the
local and remote admins for managing the wincomlpd server.
The problem here is very simple: the authentication method used by
the program is practically unexistent.
In short an attacker can manage the wincomlpd server without knowing
the admin username and password but simply skipping the auth stage.
This bug can be exploited in at least two ways: writing an alternative
client (the protocol is enough simple so it's not a problem) or just
modifying the admin client program (LPDAdmin.exe).
------------------------------------------------
C] integer memcpy crash in remote administration
------------------------------------------------
The 8 and 16 bit values used in the remote administration protocol for
specifying respectively the length of the strings (like the printer's
name to add) and the size of the data block are signed integers.
That allows an attacker to crash the remote wincomlpd service simply
using negative values like 0x80 or 0xff for the 8 bits numbers and
0x8000 or 0xffff for the data block and so on.
This bug can be also used for exploiting the subsequent vulnerability.
-------------------------------------------
D] buffer-overflow in remote administration
-------------------------------------------
A buffer-overflow is located in the function which copies the data from
the values explained before in a stack buffer.
Naturally the criticality of the above two vulnerabilities is related
to the possibility of bypassing the authentication explained in bug B.
If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.
Microsoft Device IO Control wrapped by the iphlpapi.dll API shipping with Windows Vista 32 bit and 64 bit contains a possibly exploitable, buffer overflow corrupting kernel memory.