CVE-2005-1984

An attacker sends a specially crafted message to the Print Spooler service on an affected system [ref_id=1]. On Windows 2000 and Windows XP Service Pack 1, this can be done by any anonymous user over the network, as the service is reachable via null session pipes by default [ref_id=1]. On Windows XP Service Pack 2 and Windows Server 2003, the attack is restricted to authenticated users, and a remote attack vector only exists if a user with appropriate permissions has shared a printer or attempted to connect to a shared printer [ref_id=1]. The unchecked buffer in Spoolsv.exe overflows when processing the malicious message, potentially allowing arbitrary code execution [ref_id=1].

The vulnerability resides in the Print Spooler service executable, Spoolsv.exe, which is installed as a service on Microsoft Windows 2000, Windows XP, and Windows Server 2003 [ref_id=1]. The advisory states that "an unchecked buffer in the Print Spooler service" is the cause [ref_id=1]. No specific function or file path within Spoolsv.exe is named in the available references.

The security update corrects the vulnerability by ensuring the Print Spooler service properly validates message length before copying data into a buffer [ref_id=1]. No patch diff is available in the bundle; the advisory only states that the update resolves the "unchecked buffer" condition [ref_id=1]. Microsoft recommends all affected customers apply the update immediately, and notes that disabling the Print Spooler service or removing SPOOLSS from the NullSessionPipes registry key can serve as interim workarounds [ref_id=1].