| Description: | Summary:
The script tries to detect Windows 'Uninstall' registry entries
and 'Services' using an unquoted path containing at least one whitespace.
Vulnerability Insight:
If the path contains spaces and is not surrounded by quotation
marks, the Windows API has to guess where to find the referenced program. If e.g. a service is
using the following unquoted path:
C:\Program Files\Folder\service.exe
then a start of the service would first try to run:
C:\Program.exe
and if not found:
C:\Program Files\Folder\service.exe
afterwards. In this example the behavior allows a local attacker with low privileges and write
permissions on C:\ to place a malicious Program.exe which is then executed on a service/host
restart or during the uninstallation of a software.
NOTE: Currently only 'Services' using an unquoted path are reported as a vulnerability. The
'Uninstall' vulnerability requires an Administrator / User to actively uninstall the affected
software to trigger this vulnerability.
Vulnerability Impact:
A local attacker could gain elevated privileges by inserting an
executable file in the path of the affected service or uninstall entry.
Affected Software/OS:
Software installing an 'Uninstall' registry entry or 'Service'
on Microsoft Windows using an unquoted path containing at least one whitespace.
Solution:
Either put the listed vulnerable paths in quotation by manually
using the onboard Registry editor or contact your vendor to get an update for the specified
software that fixes this vulnerability.
CVSS Score:
9.3
CVSS Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
