PT-2025-1387 · Revenera · Revenera Installshield

Published 2025-01-30 · Updated 2025-01-31 · CVE-2023-29080

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Revenera InstallShield versions 2021 R2 through 2022 R2

Description The issue concerns a potential privilege escalation vulnerability due to the addition of an InstallScript custom action to a Basic MSI or InstallScript MSI project. This action extracts binaries to a predefined writable folder during installation time. Since the standard user account has write access to these files and folders, replacing them during installation can lead to a DLL hijacking vulnerability.

Recommendations For Revenera InstallShield versions 2021 R2 and 2022 R2, consider disabling the InstallScript custom action that extracts binaries to a predefined writable folder until a patch is available. Restrict access to the predefined writable folder to minimize the risk of exploitation. Avoid using the affected InstallScript custom action in Basic MSI or InstallScript MSI projects until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2023-29080

Affected Products

Revenera Installshield

References · 6

• https://community.revenera.com/s/article/cve-2023-29080-security-patch-for-the-possible-privileged-escalation-scenarios-identified-in-installshield-nbsp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29080 · Security Note
• https://t.me/cvedetector/16810 · Telegram Post
• https://t.me/cvenotify/109254 · Telegram Post
• https://twitter.com/CVEnew/status/1885022680404930687 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1885137727386980510 · Twitter Post