Is VT 107303 a false positive?

[cfi]

Hi,

and thanks again for the detailed info.

@jake

If I understand the plugin code correctly, the plugin looks for unquoted service paths AND uninstall paths, but it only shows service paths in the plugin output.

Not exactly, the plugin will report both in the plugin output but only the “unquoted service” path as a vulnerability and the “uninstall path” as a “log level” entry for the reason explained in the “insight” tag of the plugin.

@jake

GVM 8.0+beta1; OpenVAS Scanner 6.0+beta2;

Please try to revert to a stable release for productive use for the reason explained in SIGSEGV occurred with openvassd 6 from master - #2 by cfi - Greenbone Community Edition - Greenbone Community Forum. This makes sure that this is not just caused by a bug in GVM which is outside of the scope of this category and topic.

@jake

4. No output besides the boilerplate

Could you specify the output you got which helps a little bit better what you’re seeing? E.g. the plugin might show to different outputs:

1. The following 'Uninstall' registry entries are using an 'unquoted' path: with a severity of 0.0

2. The following services are using an 'unquoted' service path: with a severity of 9.3

Which one of the both did you get in your report?

@jake

As an aside, how do I learn to become a contributor to the plugins/project? I’d be glad to be able to participate in the community once I start understanding nasl code better.

The pinned topic VT Development - Vulnerability Tests - Greenbone Community Forum as well as existing examples or asking questions related to NASL coding / plugin development within this category could be used as a starting point.