Macrovision InstallShield Update Service ActiveX Unsafe Method Vulnerability
1 Nov. 2007
Summary
MacroVision InstallShield is "an installer solution utilized by many software vendors in order to ensure that their products are delivered and setup properly on the end-user systems. InstallSheild includes support for an optional component called the 'Update Service'. This service allows vendors to notify clients of product patches and updates, and allow them to be easily installed". Remote exploitation of an unsafe method vulnerability in Macrovision InstallShield Update Service allows attackers to execute arbitrary code with the privileges of the currently logged-in user.
Vulnerable Systems:
* Macrovision InstallShield Update version 5.01.100.47363, and 6.0.100.60146
The Update Service is implemented as an ActiveX control with the following properties:
CLSID: E9880553-B8A7-4960-A668-95C68BED571E
File: C:\Windows\Downloaded Files\isusweb.dll
Version: 5.01.100.47363, and 6.0.100.60146
This control is marked "safe for scripting". Several methods within this control can be utilized by attackers to download and launch arbitrary executables.
Analysis:
Exploitation allows attackers to execute arbitrary code with the privileges of the currently logged-in user. In order for exploitation to occur, users would be required to have a vulnerable version of the software installed and be lured to a malicious site. Even though the update control does display an interface, no additional interaction is required in order for exploitation to occur.
Since this control is marked "safe for scripting", it can be launched from a web page without warning dialogs. While it is possible for an alert user to determine what is occurring and cancel the installation, the window of opportunity is small and based solely upon the time required for the system to complete the download.
Workaround:
Administrators can set the kill-bit for the vulnerable ActiveX control with the following .reg file. This will prevent the control from loading within Internet Explorer.
Vendor response:
Macrovision has addressed this vulnerability by releasing updated versions of their FlexNet and InstallShield products. They report that the new versions are no longer marked as "safe for scripting". For more information, consult the following URL: http://www.macrovision.com/promolanding/7660.htm
