![]() To perform secondary actions during an installation or uninstallation - such as performing system checks or, in this instance, verifying an uninstall token - Microsoft recommends using Custom Actions (CA) via msiexec.exe.ĭuring an uninstallation of Falcon, several instances of msiexec.exe run in parallel performing various tasks. On August 22, 2022, modzero published a blog post that included their proof of concept code and submitted a CVE entry citing that blog post (at time of writing, this CVE is still under analysis).įalcon is installed and uninstalled on Windows systems using the Microsoft Installer (MSI) harness. On August 12, 2022, after additional research and documentation, CrowdStrike submitted a bug report to Microsoft detailing the issue with Microsoft Installer (MSI) custom actions. The security firm modzero was credited with the disclosure and discovery of the issue. On July 8, 2022, CrowdStrike disclosed this issue to its customers via a tech alert. On June 29, 2022, CrowdStrike was contacted by security firm modzero concerning a security issue with the Falcon uninstall process and provided technical details and proof of concept code. Today that Tech Alert was updated to include the details below. ![]() ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |