Whats the scope of the vulnerabilities?
There are two distinct vulnerabilities at issue here, but their overall effect is that a user could crash the print spooler on a server or run arbitrary code in a privileged state, either on the server or on the local machine. The first vulnerability is a buffer overrun vulnerability that could be exploited in two ways. In the simplest case, a malicious user could simply crash the spooler service as a denial of service attack. An administrator would need to restart the service, but in most cases would not need to reboot the server. The vulnerability could also be used in more advanced attacks to run arbitrary code on the server. This would constitute a privilege elevation because the print spooler runs in a System context. The chief limiting factor in this vulnerability is the fact that most of the affected APIs can only be called by a member of the Administrators or Power Users groups. However, at least one can be called by a normal user. The calls can be made remotely, if the user wa
