Summary  Adding an InstallScript custom action to a Basic MSI or InstallScript MSI project extracts few binaries to a predefined writable folder during installation time. The standard user account has write access to these files and folders, hence replacing them during installation time can lead to a DLL hijacking vulnerability. Revenera has issued a security patch to correct this flaw.  Resolution This security fix avoids using known folders and only extracts to a new random secured folder every time the setup is launched. These secured folders have proper access controls so that the standard user cannot access them in all possible scenarios.  Patch for InstallShield 2021 R2  To apply the fix, download the InstallShield 2021 R2 Security Patch.exe and run it on the machine that has either InstallShield 2021 R2 or Standalone Build (SAB) products installed.  Patch for InstallShield 2022 R2  To apply the fix, download the InstallShield 2022 R2 Security Patch.exe and run it on the machine that has either InstallShield 2022 R2 or Standalone Build (SAB) products installed.    To run the patch installation silently:  Download the security patch setup to a temporary folder on the machine on which you want to apply the fix.  Download the  ISSecurityPatchSilentResponseFile.zip file, extract the ISSecurityPatchSilentResponseFile.iss file from the .zip file, and place the ISSecurityPatchSilentResponseFile.iss file in the same folder as the ‘InstallShield 2022 R2 Security Patch.exe’ or ‘InstallShield 2021 R2 Security Patch.exe’ patch file.  Open a Command Prompt window with elevated privileges. (To do so, right-click the shortcut for the Command Prompt window, and then click Run as administrator.)  Run the following command:  "C:\Path\InstallShield <Version> R2 Security Patch.exe" /s /f1"C:\Path\ISSecurityPatchSilentResponseFile.iss"  where the path (C:\Path\) is replaced with the appropriate location and the <Version> is replaced with either 2022 or 2021. When the patch is run, it will correct all the identified security flaws in the above products that are installed on the machine.    To determine if the InstallShield Hotfix has been installed, verify the version of the following files:  The following files will be updated to version 28.0.0.763 (InstallShield 2022 R2) and version 27.0.0.126 (InstallShield 2021 R2):    <ISInstallLocation>\Redist\Language Independent\i386  ISSetup.dll  setup.exe  setupPreReq.exe  SFHelper.dll    <ISInstallLocation>\Redist\Language Independent\x64  setup.exe  setupPreReq.exe  SFHelper.dll     <ISInstallLocation>\Redist\Language Independent\i386\ISP  ISSetup.dll setup.exe  Setup.ocx    <ISInstallLocation>\System  ISSetup.dll  ... View more

Symptoms: When you are building an InstallShield MSIX project, the following warning may occur: warning -9583: Restricted capabilities like localSystemServices and packagedServices are only needed if your MSIX project is configured with windows.service extension. Diagnosis: This build warning occurs when above capabilities are selected in Capabilities view and windows.service extension is not included in the package. Solution: Check if windows.service is configured in the package and try one or more of the following steps to resolve the issue: If no service is added in the MSIX package, manually unselect above mentioned restricted capabilities from Capabilities view. If service declaration is added, then make sure corresponding declaration set is selected for a given application entry in the Applications View. Additional Information The restricted capabilities localSystemServices and packagedServices allows applications that are created by Microsoft partners and enterprises to declare the windows.service extension in its package manifest so that it can install one or more services along with the app. These services can be configured to run under the Local Service, Network Service, or Local System accounts. Local Service and Network Service services only require the packagedServices capability. Local System services require the packagedServices and localSystemServices capabilities. ... View more

Symptoms: When you are building an InstallShield MSIX project, the following error may occur: error -9582: MSIX services configured to run under the Local Service or Network Service accounts require the packagedServices restricted capability. Diagnosis: This build error occurs when windows.service extension is configured with Local Service or Network Service as startup account type and does not have packagedServices capability included in the package. Solution: To fix above error, select 'Packaged Services' restricted capability from MSIX project Capabilities view. ... View more

Symptoms: When you are building an InstallShield MSIX project, the following error may occur: error -9581:  MSIX services configured to run under the Local System account require the packagedServices and localSystemServices restricted capabilities. Diagnosis: This build error occurs when windows.service extension is configured with LocalSystem account as startup account type, and does not have the following capabilities included in the package: packagedServices localSystemServices Solution: To fix this error, select above restricted capabilities from MSIX project Capabilities view. ... View more

Symptoms: When you are building an InstallShield MSIX project, the following error may occur: warning -9580: This package has services configured. Hence, updating TargetDeviceFamily versions to minimum supported operating system version (Windows 10, version 2004, build number 19041). Diagnosis: Windows 10, version 2004, introduces support for running an MSIX package that includes services. Hence Target Device versions will be updated automatically by InstallShield if MSIX package contains NT service (windows.service extension).  Solution: This warning can be ignored if no changes are required for TargetDeviceFamily versions defined in the manifest file. To override default behavior, configure ‘Include Desktop Extensions’ property in Releases view as required. ... View more

Symptoms: Error -9579: MSIX packages with services support is available starting with Windows 10, Version 2004 (build number 19041). Hence, Target Device versions need to be configured accordingly. Packages targeting MSIX features that are not available in specified TargetDeviceFamily versions may not work as expected. App Installer may throw the error. Diagnosis: Windows 10, version 2004, introduces support for running an MSIX package that includes services. Hence Target Device versions need to be configured accordingly if MSIX package contains NT services (windows.service extension). Solution: Configure ‘Include Desktop Extensions’ property in Releases view to have right values or leave these values as blank to let InstallShield automatically configure these values while creating MSIX manifest file. ... View more

Symptoms: ISDEV : warning -9578:  Services configured with dependencies outside the MSIX package are not currently supported by Microsoft. '%1' is not a valid Dependency Service. %1 is a placeholder that contains the dependency name (referred as part of windows.service extension) causes this warning. App Installer may throw weird error if definitions for dependency service names are not included as part of MSIX package.  Diagnosis: This build warning is shown when Dependency Services are configured in windows.service extension and the same is not included as part of the MSIX package. Windows 10, version 2004, introduces support for running an MSIX package that includes services and this release currently does not support services with dependencies outside the package. Solution: One or more of the following steps resolve the issue: Remove either dependency names or create new windows.service extension for referred dependency service name. Check Microsoft latest documentation on MSIX services and see if this limitation is addressed in the latest release. ... View more

Symptoms: During a build, you receive the following build error: ISDEV : error -9577: Error building Modification Package. Base Package Name in General Information view is empty. Diagnosis: This build error has been triggered when building modification package project with base package name is empty. Base Package name is mandatory when you create a modification package that has a strict binding to the main app. Solution: To resolve this build error, set the main package identity name as Base Package Name in General Information view. ... View more