Executive Summary

CVE-2016-20093 is an unquoted service path vulnerability found in Wise Care 365 version 4.27 and Wise Disk Cleaner version 9.29. It affects the WiseBootAssistant and SpyHunter 4 Service components respectively. Because the service paths are not enclosed in quotes, a local attacker can place malicious executable files in the system root path. During system startup or reboot, the operating system may mistakenly execute the attacker's malicious executable instead of the legitimate service, allowing the attacker to run arbitrary code with SYSTEM-level privileges.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a local attacker to escalate their privileges to SYSTEM level by executing arbitrary code during service startup or system reboot. This means the attacker can gain full control over the affected system, potentially installing malware, stealing sensitive data, modifying system settings, or disrupting system operations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves unquoted service paths in the WiseBootAssistant and SpyHunter 4 services, which can be detected by checking the service executable paths for missing quotes.

To detect the vulnerability on a Windows system, you can list the services and inspect their executable paths for unquoted spaces. For example, use the following command in an elevated Command Prompt or PowerShell:

• sc qc WiseBootAssistant
• sc qc SpyHunter4Service

Look for the "BINARY_PATH_NAME" field in the output. If the path contains spaces and is not enclosed in quotes, the service is vulnerable.

Alternatively, you can use PowerShell to find all services with unquoted paths:

• Get-WmiObject win32_service | Where-Object { $_.PathName -match ' ' -and $_.PathName -notmatch '"' } | Select-Object Name, PathName

This command lists services whose executable paths contain spaces but are not quoted, indicating potential vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this unquoted service path vulnerability, immediately ensure that the service executable paths are properly quoted to prevent execution of malicious files.

You can fix the service path by editing the registry or using the sc command to update the service configuration with quoted paths.

• Use the command: sc config WiseBootAssistant binPath= ""C:\Program Files\WiseCare365\WiseBootAssistant.exe""
• Use the command: sc config SpyHunter4Service binPath= ""C:\Program Files\WiseDiskCleaner\SpyHunter4.exe""

Additionally, restrict write permissions on the directories in the service path to prevent attackers from placing malicious executables.

As a general best practice, keep the affected software updated to versions where this vulnerability is patched or no longer present.

Useful 0 Not Useful 0