Hello,
I would like to report a vulnerability found with the latest Nessus Forwarder (5.0.1) installed on all our Windows Servers. We can solve that via registry change, but it would be nice if that will be fixed in a newer Nessus forwarder version.
To fix that by hand search for 'C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe' in the registry. Once you found the service for it (it has a description key on top of this key). You need to add " in front and after it. Example "C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"
There is no reboot or restart required!
Synopsis: The remote Windows host has at least one service installed that uses an unquoted service path.
Description: The remote Windows host has at least one service installed that uses an unquoted service path, which contains at least one whitespace. A local attacker could gain elevated privileges by inserting an executable file in the path of the affected service.
Solution: Ensure that any services that contain a space in the path enclose the path in quotes.
See Also
:
http://isc.sans.edu/diary.html?storyid=14464
http://cwe.mitre.org/data/definitions/428.html
http://www.commonexploits.com/?p=658
Risk Factor: High
CVSS Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score
6.5 (CVSS2#E:F/RL:W/RC:C)
Plugin Output
Nessus found the following service with an untrusted path:
SplunkForwarder : C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe
