This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

How do I check for " in a registry value?

bill_prentice over 11 years ago

In a recent security audit we had several findings on the workstations involving services that did not have double quotes around the path. IOW, c:\program files\program\executable instead of "c:\program files\program\executable".

I have the registry files built and test for all of these but I am having trouble with the package definition. When I crate the Installed Rule and include the double quotes I get an error stating C is an unknown token. If I put the value as defined in the registry file ("\"C:\\program files\\program\\executable\"") I get the same message but for the character \.

I thought of adding a second value to indicate it had been installed but I need to have this be more than a one time fix - if the program path registry value gets updated with no quotes I need to set it back to quotes.

HELP!

0 pooranivalli.kumaravelu over 11 years ago

Hi,
Firstly what is that you want to check with the registry keys created for the executable? Which version is installed? If that is the case can you try to modify your installed rule the following way and let me know if it works as you expected.
Use the Rule type : File version with registry value
Registry key :
Sample : (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ executable.exe)
Registry Value : Path
Sub-path : executable.exe
Comparison : equal to
Version : the version of the executable
Cancel
Vote Up 0 Vote Down

Cancel
0 bill_prentice over 11 years ago in reply to pooranivalli.kumaravelu

I'm not looking for a version - I'm trying to see if the string value has " or not. If it does not have the path in the string value surrounded by " marks I need to apply a patch to reset that.
Cancel
Vote Up 0 Vote Down

Cancel
0 David_Di_Blasio over 11 years ago in reply to bill_prentice

Hi Bill,
Although I have not tested it you may try using &quot instead of " as this is the proper xml declaration.
Cancel
Vote Up 0 Vote Down

Cancel
0 David_Di_Blasio over 11 years ago in reply to David_Di_Blasio

Scratch that idea I tested it and it failed as well.
Cancel
Vote Up 0 Vote Down

Cancel