Test ID:	1.3.6.1.4.1.25623.1.0.10432
Category:	Windows
Title:	SMB Registry : permissions of keys that can change common paths
Summary:	NOSUMMARY
Description:	Description: This script checks whether the following keys can be modified by non admins : HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths HKLM\Software\Microsoft\Windows\CurrentVersion\Controls Folder HKLM\Software\Microsoft\Windows\CurrentVersion\DeleteFiles HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer HKLM\Software\Microsoft\Windows\CurrentVersion\Extensions HKLM\Software\Microsoft\Windows\CurrentVersion\ExtShellViews HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage HKLM\Software\Microsoft\Windows\CurrentVersion\RenameFiles HKLM\Software\Microsoft\Windows\CurrentVersion\Setup HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall HKLM\Software\Microsoft\Windows NT\CurrentVersion\Compatibility HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers HKLM\Software\Microsoft\Windows NT\CurrentVersion\drivers.desc HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\0 HKLM\Software\Microsoft\Windows NT\CurrentVersion\Embedding HKLM\Software\Microsoft\Windows NT\CurrentVersion\MCI HKLM\Software\Microsoft\Windows NT\CurrentVersion\MCI Extensions HKLM\Software\Microsoft\Windows NT\CurrentVersion\Ports HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList HKLM\Software\Microsoft\Windows NT\CurrentVersion\WOW These keys contain paths to common programs and DLLs. If a user can change a path, then he may put a trojan program into another location (say C:/temp) and point to it. Solution : use regedt32 and set the permissions of this key to : - admin group : Full Control - system : Full Control - everyone : Read Risk factor : High
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-1999-0589 https://www.cve.org/CVERecord?id=CVE-1999-0589
Copyright	This script is Copyright (C) 2000 Renaud Deraison

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.