Issue Details (XML | Word | Printable)

Key: CORE-6112
Type: Improvement Improvement
Status: Open Open
Priority: Minor Minor
Assignee: Unassigned
Reporter: Karsten Stock
Votes: 0
Watchers: 3

If you were logged in you would be able to see more operations.
Firebird Core

Instsvc does not add quotes to the service-path in registry

Created: 31/Jul/19 03:01 PM   Updated: 31/Jul/19 03:01 PM
Component/s: Installation
Affects Version/s: 3.0.4
Fix Version/s: None

Environment: Windows

QA Status: No test

 Description  « Hide
Our cyber security test team filed a bug, because of the "Unquoted service-path" to the firebird executable in registry:

A local attacker can gain elevated privileges by inserting an executable file in the path of the affected service.

Unquoted service paths are a older vulnerability that occurs when the path to an executable service or program (commonly uninstallers) are unquoted and contain spaces.
If we look at the path to the executable, it is specified without quotes. In this case, the execution method of Windows can be bypassed. When the path has a space in between and is not specified in quotes.

Ensure that any services that contain a space in the path enclose the path in quotes.

 All   Comments   Change History   Subversion Commits      Sort Order: Ascending order - Click to sort in descending order
There are no comments yet on this issue.