Description of problem: This was reported by a community user, and examined with the SRT representative to be a hardening issue and not security issue; The services ovirt installs don't have quoted binary paths, as you can see bellow. OVirtGuestService : C:\Program Files (x86)\oVirt Guest Tools\OVirtGuestService.exe vdservice : C:\Program Files (x86)\oVirt Guest Tools\64\vdservice.exe BalloonService : C:\Program Files (x86)\oVirt Guest Tools\drivers\Balloon\2k12r2\amd64\blnsvr.exe Version-Release number of selected component (if applicable): ovirt-guest-tools-iso-4.2-1.el7.centos Actual results: Unquoted path with space for guest binaries. Expected results: Quoted path being used. Additional info: For more information you can take a look at https://www.commonexploits.com/unquoted-service-paths/ and http://cwe.mitre.org/data/definitions/428.html
Build is available in ovirt-4.2-pre repo: https://resources.ovirt.org/pub/ovirt-4.2-pre/iso/oVirt-toolsSetup/4.2-3.el7/oVirt-toolsSetup-4.2-3.el7.iso
Verified on oVirt Guest Tools 4.2-3.el7 All paths are quoted correctly.