Getting Data In

The remote Windows host has at least one service installed that uses an unquoted service path.

BastianW
Path Finder

Hello,

I would like to report a vulnerability found with the latest Nessus Forwarder (5.0.1) installed on all our Windows Servers. We can solve that via registry change, but it would be nice if that will be fixed in a newer Nessus forwarder version.

To fix that by hand search for 'C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe' in the registry. Once you found the service for it (it has a description key on top of this key). You need to add " in front and after it. Example "C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"

There is no reboot or restart required!


Synopsis: The remote Windows host has at least one service installed that uses an unquoted service path.



Description: The remote Windows host has at least one service installed that uses an unquoted service path, which contains at least one whitespace. A local attacker could gain elevated privileges by inserting an executable file in the path of the affected service.


Solution: Ensure that any services that contain a space in the path enclose the path in quotes.


See Also
:
http://isc.sans.edu/diary.html?storyid=14464
http://cwe.mitre.org/data/definitions/428.html

http://www.commonexploits.com/?p=658



Risk Factor: High



CVSS Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)

CVSS Temporal Score
6.5 (CVSS2#E:F/RL:W/RC:C)


Plugin Output
Nessus found the following service with an untrusted path: 

SplunkForwarder : C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe

1 Solution

jbsplunk
Splunk Employee
Splunk Employee

This is a known issue, SPL-59920, which will be resolved with 5.0.3.

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

This is a known issue, SPL-59920, which will be resolved with 5.0.3.

View solution in original post

BastianW
Path Finder

Great thanks for the information.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!