Executive Summary

This vulnerability is an unquoted service path issue in the memoQ Auto Update Service (memoQauhlp101) in memoQ version 10.1.13.ef1b2b52aae and earlier. Because the service path contains spaces but is not enclosed in quotes, a local user can place a malicious executable named C:\Program.exe, which the system might execute with elevated privileges, allowing the user to escalate their privileges to SYSTEM.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows a local user to escalate their privileges to SYSTEM level by exploiting the unquoted service path. This means an attacker with local access could gain full control over the affected system, potentially leading to unauthorized access, data manipulation, or further compromise of the system.

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by checking the service path of the memoQ Auto Update Service (memoQauhlp101) to see if it is unquoted and contains spaces. On a Windows system, use the command: sc qc memoQauhlp101. Review the BINARY_PATH_NAME output to see if the path is unquoted and contains spaces, which indicates the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately correct the service path by adding quotes around the executable path in the service configuration to prevent privilege escalation. Alternatively, ensure no malicious executable exists at C:\Program.exe and restrict write permissions to this location to prevent exploitation.

Useful 0 Not Useful 0