What causes the print provider vulnerability?
First, let’s define what a print provider is. Print providers are pieces of software that handle particular printing tasks. For instance, there is a print provider that handles print requests that originate from non-Microsoft operating systems. Windows NT comes equipped with a number of standard print providers, but also provides the ability to install custom ones as well. By design, only administrators should be able to install print providers, because they run in the security context of the local system. However, certain print providers allow normal users to install them as well. A malicious user could install a custom print provider as a way of getting code to run in a higher privilege than he or she has. However, they could only use this vulnerability to run code on the local machine, because print providers can’t be added remotely.
