One of our clients regularly PEN test their servers and one issue was detected:

See link below:

Microsoft Windows Unquoted Service Path Enumeration | Tenable®

It doesn't like spaces in the filepath for the LH service executable, claiming that "A local attacker can gain elevated privileges by inserting an executable file in the path of the affected service".

It can be addressed just by enclosing the ImagePath in quotes at

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LinearHash

I've tried it and there doesn't appear to be any operational problem doing this. Could there be anything else looking at the ImagePath key though?

Cheers, M@

Vernon Systems

Hi, Matt. Certainly nothing inside the product looks at the ImagePath during normal operation. If the service still runs (which means you've quoted it correctly), I think that's sufficient proof that it's working.

If you wanted some extra verification, you could open a DOS cmd prompt, CD to the folder where your UD is installed (c:\revsoft\universal driver), and issue some commands to stop and restart the service:

lh47nul stop

lh47nul start

If those work, then I think everything is fine.

- Bryan Shumsky

Revelation Software, Inc.

Hi, Certainly nothing inside the product looks at the ImagePath during normal operation. If the service still runs (which means you've quoted it correctly), I think that's sufficient proof that it's working.

Great, thanks for confirming Bryan.

Cheers, M@

Vernon Systems

View this thread on the Works forum...