Getting Data In

The remote Windows host has at least one service installed that uses an unquoted service path.

BastianW
Path Finder

Hello,

I would like to report a vulnerability found with the latest Nessus Forwarder (5.0.1) installed on all our Windows Servers. We can solve that via registry change, but it would be nice if that will be fixed in a newer Nessus forwarder version.

To fix that by hand search for 'C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe' in the registry. Once you found the service for it (it has a description key on top of this key). You need to add " in front and after it. Example "C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe"

There is no reboot or restart required!


Synopsis: The remote Windows host has at least one service installed that uses an unquoted service path.



Description: The remote Windows host has at least one service installed that uses an unquoted service path, which contains at least one whitespace. A local attacker could gain elevated privileges by inserting an executable file in the path of the affected service.


Solution: Ensure that any services that contain a space in the path enclose the path in quotes.


See Also
:
http://isc.sans.edu/diary.html?storyid=14464
http://cwe.mitre.org/data/definitions/428.html

http://www.commonexploits.com/?p=658



Risk Factor: High



CVSS Base Score
7.2 (CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C)

CVSS Temporal Score
6.5 (CVSS2#E:F/RL:W/RC:C)


Plugin Output
Nessus found the following service with an untrusted path: 

SplunkForwarder : C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe

1 Solution

jbsplunk
Splunk Employee
Splunk Employee

This is a known issue, SPL-59920, which will be resolved with 5.0.3.

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

This is a known issue, SPL-59920, which will be resolved with 5.0.3.

BastianW
Path Finder

Great thanks for the information.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...