Announcement

Collapse
No announcement yet.

Windows Update 3072630 and Custom Action

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • Windows Update 3072630 and Custom Action

    Windows Update 3072630 and Custom Action
    EDIT: I corrected the title. Should be line above...

    Since July 15th users have complained that our MSI installer can fail (ver 2.1.1011). We see it fails during a Custom Action that launches a DLL that does writing to registry and creates some files.
    We found this
    The Microsoft Security Response Center is part of the defender community and on the front line of security response evolution. For over twenty years, we have been engaged with security researchers working to protect customers and the broader ecosystem.


    Do you think there is a problem with running Custom Actions after this Windows security fix.
    Thanks
    Last edited by Ulrich; 08-14-2015, 11:31 PM. Reason: fix title

  • #2
    If we disable Windows Update 3072630
    Resolves a vulnerability in Windows that could allow elevation of privilege if the Windows Installer service incorrectly runs custom action scripts.

    the MSI Custom Action Dll runs fine.
    It seems to be a security issue related to the permissions passed to the DLL by the Custom Action.

    Comment


    • #3
      As I understand it, you may need to perform the actions differently. If you require writing into the registry, possibly you can use Windows Installer's own functions for that instead of using a DLL.

      Ulrich

      Comment

      Working...
      X