User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31 Steps to reproduce: The path used to launch the MozillaMaintenance Service "MozillaMaintenance" uses an unquoted string. C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe Version: 184.108.40.20693 Actual results: This can allow a local user to elevate privileges and execute code under the LocalSystem account. The windows API will attempt to launch the following: C:\Program.exe C:\Program Files.exe C:\Program Files (x86)\Mozilla.exe C:\Program Files (x86)\Mozilla Maintenance.exe C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe Expected results: The service path should use a quoted string to ensure spaces are not treated as delimiters and arbitrary code is not run under the elevated account.
Kamil, would you like to take a look? Let me know if you'd like help. Thanks.
The path is quoted as of bug 748764. bbondy, can you confirm?
Let's hold off on asking kamil, etc. until after bbondy confirms. Thanks
Hi Sean, this was a past issue with old installers, but it has since been fixed. We also recently created a fix so that upgraded versions will get auto-fixed. Did you just install a fresh build and notice this? Or did you have an older version that's been upgrading for a while? If this later case is your situation then it should be fixed by the work in bug 854088. So this bug would be a dupe of that one.
Thanks Brian, Yeah it's the 2nd scenario. The system has an older version that has been updated for sometime.
Checked with a clean install the path is quoted properly, So this looks like a dupe.