After connecting to \\server\PIPE\SPOOLSS you can send probably any
amount of data to that pipe. Final effect is a memory leak in
SPOOLSS.EXE. The worst thing is, by default this connection can be
initiated over null-session (setting RestrictAnonymous to 1 has no
effect). To disable attack over null-session, you must remove line
"SPOOLSS" from
HKLM\System\CCS\Services\LanmanServer\Parameters\NullSessionPipes
(REG_MULTI_SZ), but after that authenticated users can still fill up
server's memory.
If you want source of leaking program and binary, simply send mail to
oholas@exch.digi-trade.cz and put "SPOOLSS REQUEST" (without quotation
marks) as a message subject.
Ondrej Holas, MCSE, MCT
DIGI TRADE
Prague, Czech Republic