CVE-2023-29081 InstallShield Symlink Vulnerability Affecting Suite Project Setups
Locally authenticated users can cause a Denial of Service in InstallShield Suite Setups via symlink attacks on temporary folders.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-29081?
CVE-2023-29081 is a medium-severity denial of service vulnerability in Revenera InstallShield, published on 26 Jan 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability has been reported in Suite Setups built with versions prior to InstallShield 2023 R2. This vulnerability may allow locally authenticated users to cause a Denial of Service (DoS) condition when handling move operations on local, temporary folders.
Weakness: CWE-276
Which versions are affected by CVE-2023-29081?
It affects 1 product.
Products include Flexera Installshield.
How do I fix CVE-2023-29081?
No fix has been published for CVE-2023-29081 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-29081 being exploited?
There is no known exploitation of CVE-2023-29081 in the wild and no public exploit code.
Other vulnerabilities in Revenera InstallShield
Sources
Also known as GHSA-c5pj-hf7f-p4j3.