Google’s Project Zero team recently disclosed a poorly patched zero-day bug in Windows print spooler API that could use by an attacker to execute arbitrary code.
This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The zero-day bug can track as CVE-2020-0986 which reported to Microsoft by an anonymous user working with Trend Micro’s Zero Day Initiative (ZDI) in December 2019.
But there was no patch for 6 months ZDI ended with a public advisory of the zero-day in May after which it was exploited in the wild.
Print Spooler API (“splwow64.exe”) is a Windows core system binary that allows 32-bit applications to connect with the 64-bit printer spooler service on 64-bit Windows systems.
Upon successful exploitation of zero-day bug, an attacker could manipulate the memory of the “splwow64.exe” process to achieve execution of arbitrary code in kernel mode and can also install malicious programs, create or delete data.
Also See: How to Make a Fake Email ID in Ten Seconds?
The vulnerability still exists, just the exploitation method had to change
Google Project Zero researcher Maddie Stone said in a write-up.
The newly reported elevation of privilege flaw, identified as CVE-2020-17008, expected to resolve by Microsoft on January 12, 2021. Stone has also shared the PoC exploit of CVE-2020-17008.
