Executive Summary

CVE-2016-20095 is an unquoted service path vulnerability found in Matrix42 Remote Control Host version 3.20.0031, specifically in the FastViewerRemoteService and FastViewerRemoteProxy services.

Because the service paths are not enclosed in quotes, a local user with limited privileges can place a malicious executable with a crafted name in the Program Files directory. When the service starts or restarts, it may execute this malicious file with SYSTEM-level privileges, allowing the attacker to run arbitrary code with elevated rights.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how the unquoted service path vulnerability in Matrix42 Remote Control Host 3.20.0031 directly affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a local attacker to escalate their privileges from a limited user to SYSTEM level, which is the highest privilege on a Windows system.

• An attacker can execute arbitrary code with SYSTEM privileges.
• They can place malicious executables in the Program Files directory that will be run by the vulnerable service.
• This can lead to full system compromise, unauthorized access, and control over the affected machine.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the service paths of the FastViewerRemoteService and FastViewerRemoteProxy services for unquoted paths in the Windows registry.

Specifically, you can inspect the ImagePath registry values under HKLM\SYSTEM\CurrentControlSet\services for these services to see if the paths are missing quotes.

A common command to check this on a Windows system using PowerShell is:

• Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\services\FastViewerRemoteService' -Name ImagePath
• Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\services\FastViewerRemoteProxy' -Name ImagePath

If the returned ImagePath values are not enclosed in quotes, the system is vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, you should manually add quotes around the ImagePath registry values for the affected services.

This involves editing the registry keys at HKLM\SYSTEM\CurrentControlSet\services\FastViewerRemoteService and HKLM\SYSTEM\CurrentControlSet\services\FastViewerRemoteProxy to ensure the executable paths are enclosed in double quotes.

Additionally, restarting the affected services or the system after making these changes will ensure the fix is applied.

Avoid placing any executables with crafted names in the Program Files directory to prevent exploitation.

Useful 0 Not Useful 0