nwspool.dll buffer overflow

Passing a string of 458 or more characters in the first argument to the

OpenPrinter() function results in a buffer overflow in the Spooler

service and the overwriting of a saved instruction pointer. An

identical result is achieved by specifying a string of 524 or more

characters, followed by an exclamation point, as the second argument to

the EnumPrinters() function.

This problem is resolved in nwspool.dll dated 13Nov2006 or later.

Vulnerability was found by TippingPoint, a division of 3Com.  The advisory number is CVE‑2006‑5854.