CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
5.1%
The Flexera InstallShield application installed on the remote host is missing a vendor-supplied hotfix. It is, therefore, affected by an untrusted search path vulnerability due to looking for specific files or libraries in the current working directory, which may not be trusted or under user control. A remote attacker can exploit this, using a specially crafted DLL, by convincing a user to open a file (e.g., located on a remote WebDAV share), resulting in the injection and execution of arbitrary code.
#
# (C) Tenable Network Security, Inc.
#
include('compat.inc');
if (description)
{
script_id(89692);
script_version("1.11");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/04/19");
script_cve_id("CVE-2016-2542");
script_bugtraq_id(83334);
script_xref(name:"IAVB", value:"2016-B-0040-S");
script_name(english:"Flexera InstallShield Untrusted Search Path Vulnerability");
script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote Windows host is affected by an
untrusted search path vulnerability.");
script_set_attribute(attribute:"description", value:
"The Flexera InstallShield application installed on the remote host is
missing a vendor-supplied hotfix. It is, therefore, affected by an
untrusted search path vulnerability due to looking for specific files
or libraries in the current working directory, which may not be
trusted or under user control. A remote attacker can exploit this,
using a specially crafted DLL, by convincing a user to open a file
(e.g., located on a remote WebDAV share), resulting in the injection
and execution of arbitrary code.");
# https://flexeracommunity.force.com/customer/articles/INFO/Best-Practices-to-Avoid-Windows-Setup-Launcher-Executable-Issues
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1d6580b3");
# https://blogs.technet.microsoft.com/srd/2010/08/23/more-information-about-the-dll-preloading-remote-attack-vector/
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1f913224");
# https://blogs.flexera.com/vulnerability-management/2010/08/microsoft-windows-insecure-library-loading/
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e3269c83");
script_set_attribute(attribute:"see_also", value:"http://www.binaryplanting.com/");
script_set_attribute(attribute:"see_also", value:"https://www.commonexploits.com/unquoted-service-paths/");
script_set_attribute(attribute:"solution", value:
"Apply the vendor-supplied Hotfix IOJ-1745445. Note that this may
require an upgrade to InstallShield 2015 SP1. Furthermore, the vendor
recommends that InstallShield customers follow Windows best practices
when using custom actions since the hotfix is not applicable to custom
actions.");
script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-2542");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"vuln_publication_date", value:"2016/01/21");
script_set_attribute(attribute:"patch_publication_date", value:"2016/01/25");
script_set_attribute(attribute:"plugin_publication_date", value:"2016/03/06");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/a:flexerasoftware:installshield");
script_set_attribute(attribute:"stig_severity", value:"II");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"CGI abuses");
script_copyright(english:"This script is Copyright (C) 2016-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("flexera_installshield_installed.nbin");
script_require_keys("installed_sw/Flexera InstallShield");
exit(0);
}
include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("install_func.inc");
app = "Flexera InstallShield";
install = get_single_install(app_name:app, exit_if_unknown_ver:TRUE);
path = install["path"];
version = install["version"];
disp_ver = install["display_version"];
# This version was obtained directly from the hotfix.
# It is not directly available to the end user via the
# application or official release notes/documentation.
# We are using it as a means to detect whether or not
# the hotfix is installed.
if (disp_ver == "22.0")
fixed_version = "22.0.0.360";
else if (disp_ver == "21.0")
fixed_version = "21.0.0.350";
else if (disp_ver == "20.0")
fixed_version = "20.0.0.530";
else audit(AUDIT_INST_PATH_NOT_VULN, app, version, path);
fix_display = "Apply InstallShield 2015 SP1 Hotfix IOJ-1745445";
if (ver_compare(fix:fixed_version, ver:version, strict:FALSE) < 0)
{
port = get_kb_item('SMB/transport');
if (!port) port = 445;
report =
'\n Path : ' + path +
'\n Installed version : ' + disp_ver +
'\n Fix : ' + fix_display +
'\n';
security_report_v4(severity:SECURITY_HOLE, port:port, extra:report);
}
else audit(AUDIT_INST_PATH_NOT_VULN, app, version, path);
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
5.1%