✕

Rewterz Annual Threat Intelligence Report 2025 - Download Now

Request a Demo
Rewterz

Rewterz Threat Advisory –Multiple Citrix ADC and Gateway Vulnerabilities

July 21, 2021
Rewterz

Rewterz Threat Advisory – Chinese Gas Pipeline Intrusion Campaign – Active IOCs

July 21, 2021

Rewterz Threat Advisory –Microsoft Windows Print Spooler Point and Print allows installation of arbitrary queue-specific files

Severity

High

Analysis Summary

Microsoft Windows allows for non-admin users to be able to install printer drivers via Point and Print. Printers installed via this technique also install queue-specific files, which can be arbitrary libraries to be loaded by the privileged Windows Print Spooler process. By connecting to a malicious printer, an attacker may be able to execute arbitrary code with SYSTEM privileges on a vulnerable system.

Impact

  • Arbitrary code execution
  • Privilege escalation

Affected Vendors

Microsoft

Remediation

A public exploit is available for this vulnerability

publicly available.

Refer to the Microsoft Security Bulletin MS16-087 for more workaround and updates.

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-087

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo