QID 92017

Date Published: 2023-05-10

QID 92017: Windows Installer Elevation of Privilege Vulnerability

The Microsoft Windows Installer is an installation and configuration service provided with Windows. The installer service enables customers to provide better corporate deployment and provides a standard format for component management. This vulnerability would enable an attacker to delete specific files on a targeted system but not view or modify their contents. While there is no risk to the confidentiality of the data, the vulnerability poses a significant threat to the integrity and availability of the affected system. QID Detection Logic (Authenticated):
Operating System: Windows Server 2008 and 2008 R2
The detection checks the msi.dll version and KB details: msi.dll - 5.0.7601.26514 (KB5026426)
msi.dll - 5.0.7601.26514 (KB5026413)
msi.dll - 4.5.6003.22065 (KB5026408)
msi.dll - 4.5.6003.22065 (KB5026427)

Successful exploitation could lead to the deletion of critical data, potentially causing severe disruptions to the system's services and operations.

CVSS V3 rated as High - 7.1 severity.

CVSS V2 rated as High - 6.6 severity.

Solution

Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

Vendor References

KB5026408 - support.microsoft.com/KB/5026408
KB5026413 - support.microsoft.com/KB/5026413
KB5026426 - support.microsoft.com/KB/5026426
KB5026427 - support.microsoft.com/KB/5026427

CVEs related to QID 92017

CVE-2023-24904 |

Software Advisories

Advisory ID	Software	Component	Link
Microsoft office May 2023			msrc.microsoft.com/update-guide/

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].