I have two questions How do I quickly add quotes in the registry setting for hmpalertsvc entry to change it from this C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe to this “ C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe”? When will Sophos release the update that will add the quotes as referenced above? Vulnerability Found Unquoted Service Path Nessus found the following service with an untrusted path : hmpalertsvc : C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe

In that case you could disable TP from the Central Console. I am pretty sure you can do that in bulk. If not, my next choice would be the API.

Administrator User443 I just wanted to provide an update on this issue - it's fixed in Hitmanpro component version 3.8.3. The release of that version will be happening from Nov 02 and finished by Nov 18 2021.

Take a look at this. There may be a hotfix already. community.sophos.com/.../unquoted-path-vulnerability---please-fix-asap

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

hmpalertsvc has an unquoted service path with a space in it.

Administrator User443 over 3 years ago

I have two questions

How do I quickly add quotes in the registry setting for hmpalertsvc entry to change it from this C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe to this “C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe”?
When will Sophos release the update that will add the quotes as referenced above?

Vulnerability Found Unquoted Service Path

Nessus found the following service with an untrusted path : hmpalertsvc : C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe

Unlocked temporarily for fix to be added
[edited by: Qoosh at 7:59 PM (GMT -7) on 5 Nov 2021]

Top Replies

Kyle Parrish over 3 years ago in reply to Administrator User443 +1 verified

In that case you could disable TP from the Central Console. I am pretty sure you can do that in bulk. If not, my next choice would be the API.

Parents

0 Kyle Parrish over 3 years ago
I haven't tested with Hitman...but you can try this

SC CONFIG YourServiceName binPath="C:\SomeDirectory\YourFile.EXE"
Cancel
Vote Up 0 Vote Down

Cancel
0 Administrator User443 over 3 years ago in reply to Kyle Parrish

Access is denied using that command as Sophos Intercept X is blocking changes.
Cancel
Vote Up 0 Vote Down

Cancel
0 Kyle Parrish over 3 years ago in reply to Administrator User443

Did you disable Tamper Protection?
Cancel
Vote Up 0 Vote Down

Cancel
0 Administrator User443 over 3 years ago in reply to Kyle Parrish

Yes, but I have 125 systems impacted. I do not want to have manually disable tamper protect on all of them. Is there any method schedule tamper protect to be disabled? If there is I have a script I can schedule to make the registry change.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Administrator User443 over 3 years ago in reply to Kyle Parrish

Yes, but I have 125 systems impacted. I do not want to have manually disable tamper protect on all of them. Is there any method schedule tamper protect to be disabled? If there is I have a script I can schedule to make the registry change.
Cancel
Vote Up 0 Vote Down

Cancel

Children

+1 Kyle Parrish over 3 years ago in reply to Administrator User443

In that case you could disable TP from the Central Console. I am pretty sure you can do that in bulk. If not, my next choice would be the API.
Cancel
Vote Up +1 Vote Down

Cancel
0 Administrator User443 over 3 years ago in reply to Kyle Parrish

That is information I needed. I found the tamper control on/off switch for all endpoints. I can disable, run push the change out and then re-enable. Thank you.
Cancel
Vote Up +1 Vote Down

Cancel
0 Kyle Parrish over 3 years ago in reply to Administrator User443

Happy to help!
Cancel
Vote Up 0 Vote Down

Cancel