Windows Update 3072630 and Custom Action

Ulrich replied

08-31-2015, 12:03 PM
As I understand it, you may need to perform the actions differently. If you require writing into the registry, possibly you can use Windows Installer's own functions for that instead of using a DLL.

Ulrich
Leave a comment:
DaveC replied

08-19-2015, 09:38 AM
If we disable Windows Update 3072630

MS15-074: Vulnerability in Windows Installer service could allow elevation of privilege: July 14, 2015 - Microsoft Support

https://support.microsoft.com/en-us/kb/3072630

Resolves a vulnerability in Windows that could allow elevation of privilege if the Windows Installer service incorrectly runs custom action scripts.

the MSI Custom Action Dll runs fine.
It seems to be a security issue related to the permissions passed to the DLL by the Custom Action.
Leave a comment:
DaveC started a topic Windows Update 3072630 and Custom Action

08-14-2015, 02:22 PM
Windows Update 3072630 and Custom Action

Windows Update 3072630 and Custom Action
EDIT: I corrected the title. Should be line above...

Since July 15th users have complained that our MSI installer can fail (ver 2.1.1011). We see it fails during a Custom Action that launches a DLL that does writing to registry and creates some files.
We found this

MSRC - Microsoft Security Response Center

https://technet.microsoft.com/en-us/library/security/ms15-074.aspx

The Microsoft Security Response Center is part of the defender community and on the front line of security response evolution. For over twenty years, we have been engaged with security researchers working to protect customers and the broader ecosystem.

Do you think there is a problem with running Custom Actions after this Windows security fix.
Thanks

Last edited by Ulrich; 08-14-2015, 10:31 PM. Reason: fix title
Tags: None

Announcement

Leave a comment: