Introduction Microsoft has officially announced deprecating of VBScript language from future versions of Windows. As per Microsoft, it will be an optional feature in future releases and will be preinstalled to allow uninterrupted usage for VBScript customers, while they get opportunity to migrate their scripts to other supported technologies. Microsoft Windows 11 Insider Preview Build released to Canary channel already has this change. Please refer the links in the References section for more information. Solution We recommend our customers who are currently using VBScript to start their migration process to another scripting option before Microsoft announces its complete removal in future releases. In InstallShield, VBScript has been widely used by customers to write automated build scripts and MSI custom actions. As an alternative to VBScript, we suggest using PowerShell or DLL based custom actions based on the customer use cases. Please explore blog posts and knowledge base articles available in InstallShield community for the PowerShell related topics. References InstallShield automation sample scripts using PowerShell: https://community.flexera.com/t5/InstallShield-Knowledge-Base/Use-PowerShell-to-Create-a-Project-and-Add-a-PowerShell-Custom/ta-p/184098 https://www.revenera.com/blog/software-installation/getting-started-with-installshield-automation-and-powershell/   Calling PowerShell custom actions: https://docs.revenera.com/installshield/helplibrary/CAPowerShell.htm Deprecated features list from Microsoft: Resources for deprecated features in the Windows client - What's new in Windows | Microsoft Learn Deprecated features in the Windows client - What's new in Windows | Microsoft Learn ... View more

Summary A critical vulnerability (CVE-2023-45853) is reported in 1.3 version of zlib component (https://github.com/madler/zlib) This article discusses the impact, if any, on InstallShield. Description MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. Upon analysis, InstallShield Basic MSI, InstallScript, InstallScript MSI and Suite project setups are not affected by this vulnerability as these projects do not use MiniZip component. InstallShield MSIX/APPX project flow uses MiniZip, but there are no scenarios that involves the use of comment, extra field and long filenames. Hence InstallShield setups are not impacted by this vulnerability. Resolution As a Defense-in-Depth (DiD) measure, the zlib repository change, which fixes the vulnerability for zlib upstream, has been manually merged into the InstallShield 2023 R2 release.  As the utilized version is based on zlib version 1.3.0.1, security software may still highlight InstallShield Setups as potentially vulnerable; however, this constitutes a false positive and can be safely ignored. We are actively working on migrating zlib to version 1.3.1 to reduce false positive warnings in the future. This page will be updated shortly with hotfix availability details. References NVD - CVE-2023-45853 (nist.gov)         ... View more

Introduction Below are the different ways of configuring EV USB eToken based code signing in InstallShield. Note that you will need a SafeNet USB Token connected to a machine where InstallShield software is present. You are also required to install the associated eToken management software from a certificate vendor (example SafeNet Authentication Client). Instructions Choosing 'Use a certificate store' option. Choose EV certificate entry from Personal -> User Certificate store. Please note that private key of EV certificate is stored on a separate certified hardware modules like USB tokens or HSMs and it is protected using token password. You will be prompted for a token password during signing process when the certificate is accessed from the USB token. There is also an option called 'Enable single logon' setting that comes with EV client software tool (eg. SafeNet Authentication Client) which helps to limit user interventions per session with only one token password request.  Using Custom Signing Type option. Use this option to select and configure a custom signing solution to digitally sign build-generated files. This helps to automate the scenarios where the Standard signing option is not suitable. This setting is helpful to override the InstallShield default signing flow with the custom signing solution. Choosing this option enables the additional fields where custom signing utility path and arguments can be configured. For example, you would be able to configure Microsoft Sign Tool from Windows SDK folder to take care of signing task. Using Custom Signing option to execute batch file.   Configuring batch file settings in InstallShield Signing Tab: Sample Signing.bat file contents. Use %1 variable as a place holder for the full file path to be signed. Using Custom Signing option to execute VB script. Configuring VB script in InstallShield Signing Tab:   Refer below sample VB script to retrieve the full file path to be signed. Selecting exported public key certificate file (.cer file exported). This option also provides possibility to encrypt and store EV token password in the project file. Open Authentication Client tool associated with USB eToken provider (eg. SafeNet Authentication Client) Find User certificate and click on Export file option as shown below picture. Save it as ev.cer file Go to Release => Signing Tab view in InstallShield and choose the previously exported .cer file as shown below   Configured the below required fields based on the private key properties of a user certificate in EV vendor software. Private Key Properties: Save and Build the project.  InstallShield encrypts and stores an EV token password in the project file. You will get a password prompt from EV vendor if Token Password is not configured.   ... View more

Summary  Adding an InstallScript custom action to a Basic MSI or InstallScript MSI project extracts few binaries to a predefined writable folder during installation time. The standard user account has write access to these files and folders, hence replacing them during installation time can lead to a DLL hijacking vulnerability. Revenera has issued a security patch to correct this flaw.  Resolution This security fix avoids using known folders and only extracts to a new random secured folder every time the setup is launched. These secured folders have proper access controls so that the standard user cannot access them in all possible scenarios.  Patch for InstallShield 2021 R2  To apply the fix, download the InstallShield 2021 R2 Security Patch.exe and run it on the machine that has either InstallShield 2021 R2 or Standalone Build (SAB) products installed.  Patch for InstallShield 2022 R2  To apply the fix, download the InstallShield 2022 R2 Security Patch.exe and run it on the machine that has either InstallShield 2022 R2 or Standalone Build (SAB) products installed.    To run the patch installation silently:  Download the security patch setup to a temporary folder on the machine on which you want to apply the fix.  Download the  ISSecurityPatchSilentResponseFile.zip file, extract the ISSecurityPatchSilentResponseFile.iss file from the .zip file, and place the ISSecurityPatchSilentResponseFile.iss file in the same folder as the ‘InstallShield 2022 R2 Security Patch.exe’ or ‘InstallShield 2021 R2 Security Patch.exe’ patch file.  Open a Command Prompt window with elevated privileges. (To do so, right-click the shortcut for the Command Prompt window, and then click Run as administrator.)  Run the following command:  "C:\Path\InstallShield <Version> R2 Security Patch.exe" /s /f1"C:\Path\ISSecurityPatchSilentResponseFile.iss"  where the path (C:\Path\) is replaced with the appropriate location and the <Version> is replaced with either 2022 or 2021. When the patch is run, it will correct all the identified security flaws in the above products that are installed on the machine.    To determine if the InstallShield Hotfix has been installed, verify the version of the following files:  The following files will be updated to version 28.0.0.763 (InstallShield 2022 R2) and version 27.0.0.126 (InstallShield 2021 R2):    <ISInstallLocation>\Redist\Language Independent\i386  ISSetup.dll  setup.exe  setupPreReq.exe  SFHelper.dll    <ISInstallLocation>\Redist\Language Independent\x64  setup.exe  setupPreReq.exe  SFHelper.dll     <ISInstallLocation>\Redist\Language Independent\i386\ISP  ISSetup.dll setup.exe  Setup.ocx    <ISInstallLocation>\System  ISSetup.dll  ... View more

Symptoms: When you are building an InstallShield MSIX project, the following warning may occur: warning -9583: Restricted capabilities like localSystemServices and packagedServices are only needed if your MSIX project is configured with windows.service extension. Diagnosis: This build warning occurs when above capabilities are selected in Capabilities view and windows.service extension is not included in the package. Solution: Check if windows.service is configured in the package and try one or more of the following steps to resolve the issue: If no service is added in the MSIX package, manually unselect above mentioned restricted capabilities from Capabilities view. If service declaration is added, then make sure corresponding declaration set is selected for a given application entry in the Applications View. Additional Information The restricted capabilities localSystemServices and packagedServices allows applications that are created by Microsoft partners and enterprises to declare the windows.service extension in its package manifest so that it can install one or more services along with the app. These services can be configured to run under the Local Service, Network Service, or Local System accounts. Local Service and Network Service services only require the packagedServices capability. Local System services require the packagedServices and localSystemServices capabilities. ... View more

Symptoms: When you are building an InstallShield MSIX project, the following error may occur: error -9582: MSIX services configured to run under the Local Service or Network Service accounts require the packagedServices restricted capability. Diagnosis: This build error occurs when windows.service extension is configured with Local Service or Network Service as startup account type and does not have packagedServices capability included in the package. Solution: To fix above error, select 'Packaged Services' restricted capability from MSIX project Capabilities view. ... View more

Symptoms: When you are building an InstallShield MSIX project, the following error may occur: error -9581:  MSIX services configured to run under the Local System account require the packagedServices and localSystemServices restricted capabilities. Diagnosis: This build error occurs when windows.service extension is configured with LocalSystem account as startup account type, and does not have the following capabilities included in the package: packagedServices localSystemServices Solution: To fix this error, select above restricted capabilities from MSIX project Capabilities view. ... View more

Symptoms: When you are building an InstallShield MSIX project, the following error may occur: warning -9580: This package has services configured. Hence, updating TargetDeviceFamily versions to minimum supported operating system version (Windows 10, version 2004, build number 19041). Diagnosis: Windows 10, version 2004, introduces support for running an MSIX package that includes services. Hence Target Device versions will be updated automatically by InstallShield if MSIX package contains NT service (windows.service extension).  Solution: This warning can be ignored if no changes are required for TargetDeviceFamily versions defined in the manifest file. To override default behavior, configure ‘Include Desktop Extensions’ property in Releases view as required. ... View more

Symptoms: Error -9579: MSIX packages with services support is available starting with Windows 10, Version 2004 (build number 19041). Hence, Target Device versions need to be configured accordingly. Packages targeting MSIX features that are not available in specified TargetDeviceFamily versions may not work as expected. App Installer may throw the error. Diagnosis: Windows 10, version 2004, introduces support for running an MSIX package that includes services. Hence Target Device versions need to be configured accordingly if MSIX package contains NT services (windows.service extension). Solution: Configure ‘Include Desktop Extensions’ property in Releases view to have right values or leave these values as blank to let InstallShield automatically configure these values while creating MSIX manifest file. ... View more

Symptoms: ISDEV : warning -9578:  Services configured with dependencies outside the MSIX package are not currently supported by Microsoft. '%1' is not a valid Dependency Service. %1 is a placeholder that contains the dependency name (referred as part of windows.service extension) causes this warning. App Installer may throw weird error if definitions for dependency service names are not included as part of MSIX package.  Diagnosis: This build warning is shown when Dependency Services are configured in windows.service extension and the same is not included as part of the MSIX package. Windows 10, version 2004, introduces support for running an MSIX package that includes services and this release currently does not support services with dependencies outside the package. Solution: One or more of the following steps resolve the issue: Remove either dependency names or create new windows.service extension for referred dependency service name. Check Microsoft latest documentation on MSIX services and see if this limitation is addressed in the latest release. ... View more

Symptoms: During a build, you receive the following build error: ISDEV : error -9577: Error building Modification Package. Base Package Name in General Information view is empty. Diagnosis: This build error has been triggered when building modification package project with base package name is empty. Base Package name is mandatory when you create a modification package that has a strict binding to the main app. Solution: To resolve this build error, set the main package identity name as Base Package Name in General Information view. ... View more