Unquoted Service Path Enumeration Issue

Anonymous
2023-11-20T14:39:49+00:00

I'm running into a problem with securing windows 11 23r2 systems and wanted to know if there is a workaround for the following issue:

Security Context:

CVE-2013-1609

CVE-2014-0759

CVE-2014-5455

Nessus found the following service with an untrusted path :
MDCoreSvc : C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23100.2009-0\MpDefenderCoreService.exe

This is considered a high risk finding in our security audits.

Normally to fix this you would enclose the imagePath Reg_SZ under HKLM\SYSTEM\ControlSet001\Services\MDCoreSvc in quotes. However when I attempt to do that I get an error that states "Cannot edit ImagePath: Error writing the value's new contents."

I am attempting this change under a local admin login and verified in the permissions that the Administrators security group has edit permissions on this key.

If I boot into safe mode I can make the change but then when the system reboots the edit is reverted back. IMPORTANT: this is a non-domain connected system so domain settings are not responsible for reverting the settings.

We were able to fix this issue in Windows 11 21r2 without any issues.

Any idea how to make this change?

Windows for home | Windows 11 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

27 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2024-01-17T14:49:23+00:00

    The problem I see with your "fix" is thus:

    You are updating the registry key forcefully to

    "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23100.2009-0\MpDefenderCoreService.exe"

    What happens when Microsoft change 4.18.23100.2009-0 to say 4.19.10000.1000-0?

    You are going to continually overwrite with the wrong exe path when this happens.....

    Was this answer helpful?

    0 comments
  2. Rob Koch 26,185 Reputation points Volunteer Moderator
    2024-01-09T19:42:19+00:00

    mikoake,

    There's no need to post individual responses to each post in a thread, anyone selecting to receive notifications when a new post is added would have received them already, while those like me who never do wouldn't in any case, since they're just noise to anyone who uses the forums regularly.

    I'm glad you found a potential solution for those not wanting to try and correct the useless auditors who might not believe this has been fixed, but from my standpoint I'd have simply blown the auditor out of the water if they tried to coerce me into wasting my time on something Microsoft's already apparently fixed, but the testing organizations apparently haven't caught up with yet.

    Rob

    Was this answer helpful?

    0 comments
  3. Anonymous
    2024-01-09T10:52:48+00:00

    Hi, Please see the solution I posted yesterday. It works for me. Regards, Michael

    Was this answer helpful?

    0 comments
  4. Anonymous
    2024-01-09T10:52:33+00:00

    Hi, Please see the solution I posted yesterday. It works for me. Regards, Michael

    Was this answer helpful?

    0 comments
  5. Anonymous
    2024-01-09T10:52:20+00:00

    Hi, Please see the solution I posted yesterday. It works for me. Regards, Michael

    Was this answer helpful?

    0 comments