Unquoted Service Path Vulnerability on Windows

Unquoted Service Path Vulnerability on Windows

This vulnerability has been addressed by SBT.  Please refer to the following information below to make necessary Ranger updates to prevent this vulnerability on workstations:
  1. SBTLogServiceWindows is already a deprecated service. No Ranger Core installer newer than 4.5.x.x should install this service.This Service path will linger even after uninstalling the old plugins, but you can safely delete this service path (without affecting SBTLogService)
  2. All other Services Ranger installs have also been certified for quoted paths starting from Ranger Core 4.8.1.6-X.X.X.X. Ranger Core before 4.8.1.6 might install SBT Log Service with an unquoted path.
  3. Ranger Remote Service installers starting from 2.2.1.7 will also not install any services with an unquoted path

You can read more about this vulnerability here:
https://medium.com/@harshaunsingh/windows-privileged-escalation-manual-and-using-metasploit-framework-ch-1-fd5f31a7db86

Ranger® - The universal check scanner interface
 Copyright © 2023 Silver Bullet Technology
 www.sbullet.com