InstallBuilder 21.6.0 Released

Published on

InstallBuilder version 21.6.0 has been released. Our engineers have been working on the following improvements and bug fixes:

  • Enabled Qt Professional and Professional flavors to build linux-arm32 and linux-arm64
  • Updated documentation and updated its look and feel
  • Always include osx-x86_64 runtime when generating uninstallers on macOS M1 machines
  • Support using three lines of text in installer pages titles without any cropping
  • Improved installers compatibility when running on macOS M1
  • Improved uninstaller launching process on Windows
  • Enforce full path to reg command on Windows
  • Fixed environment modification actions not properly preserving Unicode characters on Unix
  • Fixed installers crashing on some macOS 10.14.6 environments

UPDATE:

We have created two CVE entries for the “ Enforce full path to reg command on Windows” (CVE-2021-22037) and “ Improved uninstaller launching process on Windows” (CVE-2021-22038) issues fixed in InstallBuilder 21.6.0

Search Order Hijacking when performing registry actions ( CVE-2021-22037 )

InstallBuilder Windows installers are vulnerable to Path Interception by Search Order Hijacking

Background

Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command. The full path to the command is not enforced, which results in a search in the search path until a binary can be identified. This makes the uninstaller vulnerable to Path Interception by Search Order Hijacking, potentially allowing an attacker to plant a malicious reg.exe command so it takes precedence over the system command, allowing execution with the security scope of the installer/uninstaller. The attack requires previous access to the machine to be able to plant the malicious library at some point before the vulnerable installer is executed.

The vulnerability only affects Windows installers.

Remediation

Affected InstallBuilder customers should update to InstallBuilder 21.6.0 or later and release new versions.

Binary planting at uninstall time (CVE-2021-22038 )

InstallBuilder Windows uninstallers are vulnerable to a binary planting attack

Background

On Windows, the uninstaller binary copies itself to a fixed temporary location, which is then executed (the originally called uninstaller then exits, so it does not block the installation directory). This temporary location is not randomized and does not restrict access to Administrators only so a potential attacker could plant a binary to replace the copied binary right before it gets called, thus allowing execution with the security scope of the uninstaller. The attack requires previous access to the machine and to monitor the temporary directory waiting to intercept the uninstaller binary.

Remediation

Affected InstallBuilder customers should update to InstallBuilder 21.6.0 or later and release new versions.

We would like to thank the Lockheed Martin Red Team and Zscaler for reporting the issue and helping us in testing the fixes.