Summary

A potential privilege escalation issue was identified in InstallShield version 2023 R1 running a renamed Setup.exe. This article provides information about the issue and resolution.

Description

When a local administrator executes a renamed Setup.exe, the MPR.dll may get loaded from an insecure location and can result in a privilege escalation.

The preliminary CVSS for this issue: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H (7.3 score)

NOTE: CVSS metrics do not scale well, so scores generally end up in the higher score brackets using CVSS.

Resolution

The issue has been fixed in InstallShield versions 2023 R2 and later.