CVE:CVE-2007-0161
CNNVD:CNNVD-200701-110
PML Driver HPZ12服务是很多HP产品(尤其是多合一产品、打印机、扫描仪等)所安装的驱动服务。
PML Driver HPZ12服务在执行权限管理时存在漏洞，本地攻击者可能利用此权限提升自己的权限。
PML Driver HPZ12服务没有设置安全的SERVICE_CHANGE_CONFIG权限。默认下安装该服务时有以下属性：
 Name: PML Driver HPZ12
 Filename: HPZipm12.exe
 Description: Used by HP Printer/Scanner/Copier printers to prevent Windows
 from entering hibernation mode.
 File Location: %System%
 Service Name: PML Driver HPZ12
 Service Display Name: PML Driver HPZ12
由于不安全的DACL，本地非特权用户可以通过发布特制命令获得系统权限。尽管PML驱动服务不是默认安装的，但攻击者可以手动启动并终止该服务。
solution:Upgrade hp pml_driver_hpz12 to a higher version than *; Upgrade hp color_laserjet_4650 to a higher version than *; Upgrade hp officejet_4100 to a higher version than *; Upgrade hp officejet_5100 to a higher version than *; Upgrade hp officejet_5500 to a higher version than *; Upgrade hp officejet_6100 to a higher version than *; Upgrade hp officejet_7100 to a higher version than *; Upgrade hp officejet_d to a higher version than *; Upgrade hp officejet_g to a higher version than *; Upgrade hp officejet_k to a higher version than *; Upgrade hp psc_1100 to a higher version than *; Upgrade hp psc_1200 to a higher version than *; Upgrade hp psc_1210_all-in-one to a higher version than *; Upgrade hp psc_1300 to a higher version than *; Upgrade hp psc_2100 to a higher version than *; Upgrade hp psc_2200 to a higher version than *; Upgrade hp psc_2400_photosmart_all-in-one to a higher version than *; Upgrade hp psc_2500_photosmart_all-in-one to a higher version than *; Upgrade hp psc_2510_photosmart to a higher version than *; Upgrade hp psc_700 to a higher version than *; Upgrade hp psc_900 to a higher version than *