PT-2012-1260 · Flexera Macrovision · Installshield

Published 2012-01-19 · Updated 2012-01-20 · CVE-2007-6744

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Flexera Macrovision InstallShield versions prior to 2008

Description The issue involves an incorrect interaction between InstallShield and Signcode.exe, potentially allowing local users to obtain sensitive information. This occurs during certain digital-signature operations involving .spc and .pvk files, where a digital-signature password is sent to an unintended application.

Recommendations For Flexera Macrovision InstallShield versions prior to 2008, update to version 2008 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2007-6744

Affected Products

Installshield

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2007-6744 · Security Note
• http://kb.flexerasoftware.com/selfservice/microsites/search.do?cmd=displayKC&docType=kc&externalId=Installation-InstallShield-InstallShield2008Premier-Public-ProductInfo-IS2008PremProReleaseNotes2pdf&sliceId=pdfPage_42 · Note