Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Burn uses an unprotected C:\Windows\Temp directory to copy binaries and run them from there. This directory is not entirely protected against low privilege users. Details When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to drop and load multiple binaries. Standard users can hijack the binary before it's loaded in the application resulting in elevation of privileges. Built in users(non-administrators) have special permissions to this folder and can create files and write to this directory. While they do not have explicit read permissions, there is a way they can monitor the changes to this directory using ReadDirectoryChangesW API and thus figure out randomized folder names created inside this directory as wel PoC PoC works against the against visual studio enterprise with update 3 installer Reproduction steps As a standard user, run the poc. Mount the iso and run visual studio installer as local system account.…
Recommended action: Upgrade to 3.15.0-a46 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
.be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges. Details If the bundle is not run as admin, the user's TEMP folder is used and not the system TEMP folder. A utility is able to monitor the user's TEMP folder for changes and drop its own DLL into the .be/.Local folder immediately when the .be folder is created. When the burn engine elevates, the malicious DLL receives elevated privileges. PoC As a standard, non-admin user: 1. Monitor the user's TEMP folder for changes using ReadDirectoryChangesW 1. On FILEACTIONADDED, check if the folder name is .be 1. Create a folder in .be named after the bundle + .Local (e.g. MyInstaller.exe.Local) 1. Put the malicious COMCTL32.DLL in the .Local folder following the naming used for the real DLL (e.g. MyInstaller.exe.Local/x86microsoft.windows.common-controls.../COMCTL32.dll) 1. Do hacker things when the engine escalates and the malicious DLL is loaded Proper naming for the path can be…
Recommended action: Upgrade to 3.15.0-a44 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.