Unquoted Service Path vulnerability

Question

We have had a vulnerability scan carried out which highlighted several unquoted service path vulnerabilities.

These have so far been straightforward to resolve.

However there is one i am hoping someone can give a bit of guidance on

D:\Program Files (x86)\Codeless Platforms\QLTaskCentre\iwsqlea.exe nonclustered MSSQLSERVER

do the quote marks go after the .exe part of the path as in

"D:\Program Files (x86)\Codeless Platforms\QLTaskCentre\iwsqlea.exe" nonclustered MSSQLSERVER

or

"D:\Program Files (x86)\Codeless Platforms\QLTaskCentre\iwsqlea.exe nonclustered MSSQLSERVER"

Thanks

John

Answer 1

Hi

I would go with:

"D:\Program Files (x86)\Codeless Platforms\QLTaskCentre\iwsqlea.exe" nonclustered MSSQLSERVER

Gary.

Answer 2

Thanks Gary

That was my gut instinct but wanted to double check