869452 - unquoted Path used for MozillaMaintenance Service

Status: RESOLVED DUPLICATE of bug 854088

(Toolkit :: Application Update, defect)

Description

[sean]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31

Steps to reproduce:

The path used to launch the MozillaMaintenance Service "MozillaMaintenance" uses an unquoted string. 

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 

Version: 12.0.0.4493


Actual results:

This can allow a local user to elevate privileges and execute code under the LocalSystem account. 

The windows API will attempt to launch the following:

C:\Program.exe 
C:\Program Files.exe
C:\Program Files (x86)\Mozilla.exe
C:\Program Files (x86)\Mozilla Maintenance.exe
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe



Expected results:

The service path should use a quoted string to ensure spaces are not treated as delimiters and arbitrary code is not run under the elevated account.

Comment 1

[Matt Wobensmith [:mwobensmith][:matt:]]

Kamil, would you like to take a look? Let me know if you'd like help. Thanks.

Comment 2

[Robert Strong (they/them - no direct email)]

The path is quoted as of bug 748764.

bbondy, can you confirm?

Comment 3

[Robert Strong (they/them - no direct email)]

Let's hold off on asking kamil, etc. until after bbondy confirms. Thanks

Comment 4

[Brian R. Bondy [:bbondy]]

Hi Sean, this was a past issue with old installers, but it has since been fixed. We also recently created a fix so that upgraded versions will get auto-fixed.

Did you just install a fresh build and notice this? Or did you have an older version that's been upgrading for a while?  If this later case is your situation then it should be fixed by the work in bug 854088.  So this bug would be a dupe of that one.

Comment 5

[sean]

Thanks Brian, 

Yeah it's the 2nd scenario. The system has an older version that has been updated for sometime.

Comment 6

[sean]

Checked with a clean install the path is quoted properly, So this looks like a dupe.