Unquoted Service Path

povlhp

After reading isc.sans.org, and following a link to this article:

http://www.commonexploits.com/?p=658



I can see that 1Password is installed as a service with a non-quoted path, which gives someone with local access to the PC the ability to create a file "C:\Program.exe" that will be executed instead of the 1Password service, when the service is started. This app will run witht he same account as the service = Local system.



This is a major risk, please fix ASAP.





[font=courier new,courier,monospace]C:\Windows\System32>wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """[/font]

[font=courier new,courier,monospace]1Password Agile1Password[/font]

[font=courier new,courier,monospace] C:\Program Files\1Password\Agile1pService.exe[/font]



[font=courier new,courier,monospace] Auto[/font]



[size=2][font=arial, helvetica, sans-serif]PS: You are not the only one with the problem. Wacom, Seagate and IBM all have the problem on this machine as well.[/font][/size]

khad

Welcome to the forums, povlhp! Thanks for mentioning this. I've alerted the developers.



Hopefully we can resolve this shortly. If we can be of further assistance in the meantime, please let us know. We are always here to help!

Stefan von Dutch

Fixed in 1.0.9.305

povlhp

[quote name='Stefan von Dutch' timestamp='1352451179' post='63043']

Fixed in 1.0.9.305

[/quote]

Nice to see the fast response, but that is what we are getting used to from you guys.



Putting calc.exe in a file c:\Program.exe will cause lots of problems on Windows, as there are un-quoted paths everywhere. Conclusion is, that if a user can write in C:\ he can always run anything as local system. I he creates C:\documents.exe he will most likely be able to run apps as other users trying to launch stuff from thir Documents and settings folder. An old well-known Windows bug - But MS will not fix. They are afraid to break too much code. Win95 compatibility must be maintained at all costs.

khad

[quote]Nice to see the fast response, but that is what we are getting used to from you guys.[/quote]

Cheers! <img src='http://forum.agilebits.com/public/style_emoticons/<#EMO_DIR#>/smile.png' class='bbc_emoticon' alt=':)' />