Symantec Vulnerability Research SYMSA-2007-003 - Macrovision InstallAnywhere packages include an XML project configuration file named InstallScript.iap_xml. This file controls the behavior of the installation process, including verification of a password and/or serial number (if applicable). Upon starting an installer, a directory is created in temporary disk space. This directory contains multiple files, including a ZIP archive that contains the XML project file. A LaunchAnywhere executable is also created during the installation process and is used to launch the actual Java application installer. It is possible to bypass serial number and password controls by creating a copy of this temporary directory, extracting a copy of the XML project file from the ZIP archive, deleting the relevant serial number or password verification sections from the XML project file, replacing the modifiedXML project file in the ZIP archive, and then manually starting the installation process via the included LaunchAnywhere executable.
8d6368a7a5dc6be2dc66cb1a63b2011fe58892345e2214f89c6ca919ad835e5b
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed