Jump to content

Inno Setup: Difference between revisions

From Wikipedia, the free encyclopedia
Browse history interactively
← Previous editNext edit →
Content deleted Content added
VisualWikitext
No edit summary
Line 63: Line 63:
==Security==
==Security==
Installers created with InnoSetup have vulnerabilities which result in [[arbitrary code execution]] and due to their interaction with Windows' [[user account control]] additionally in [[privilege escalation]].
Installers created with InnoSetup have vulnerabilities which result in [[arbitrary code execution]] and due to their interaction with Windows' [[user account control]] additionally in [[privilege escalation]].
If run from a user's ''Downloads'' directory where an attacker has placed one of the [[DLL]]s these installers load this vulnerability results in [[remote code execution]].
When run from a user's ''Downloads'' directory where an attacker has placed one of the [[DLL]]s these installers load per [[drive-by download]] this vulnerability results in [[remote code execution]].
A [[proof of concept]] was published by Stefan Kanthak.
A [[proof of concept]] was published by Stefan Kanthak.
<ref>FullDisclosure: [http://seclists.org/fulldisclosure/2015/Dec/33 Executable installers are vulnerable^WEVIL (case 5): JRSoft InnoSetup]</ref>
<ref>FullDisclosure: [http://seclists.org/fulldisclosure/2015/Dec/33 Executable installers are vulnerable^WEVIL (case 5): JRSoft InnoSetup]</ref>

Revision as of 06:38, 25 December 2015

Inno Setup
Original author(s)Jordan Russell
Developer(s)Jordan Russell and Martijn Laan
Initial release1997; 28 years ago (1997)
Stable release
5.5.6 / July 16, 2015; 9 years ago (2015-07-16)
Repository
Written inEmbarcadero Delphi
Operating systemMicrosoft Windows
TypeSetup Creator
LicenseFree software[1]
Websitejrsoftware.org/isinfo.php Edit this on Wikidata

Inno Setup is a free script-driven installation system created in Delphi by Jordan Russell. The first version was released in 1997.

History

Since Jordan Russell wasn't satisfied with InstallShield Express which he had received upon purchase of Borland Delphi, he decided to make his own installer.[2] At first, Inno Setup was little known. The first public version was 1.09.[citation needed].

To make an installation package with version 1.09, an “ISS.TXT” file needed to be created in the installation directory. In the file, the user needed to supply variables and values which are still used in Inno Setup today. These variables served as the configuration of the installation package but many other features could not be changed. The installation compiler had no editor and was more of a shell to compile scripts.

Throughout Inno Setup's development, it was becoming more widely used. Since Inno Setup was and still is free and open source, many software companies started switching to the open source solution in software installation[citation needed]. Since Inno Setup was based around scripting, fans of Inno Setup started ISTool and ScriptMaker to aid in visual and simpler ways to make installations for Inno Setup.

Inno Setup has won many awards including the Shareware Industry Awards three times in a row - from 2002 to 2004.

Many people have taken Inno Setup source code and used it to develop third-party versions of Inno Setup. An example is My Inno Setup Extensions by Martijn Laan, which has been incorporated into Inno Setup in June 2003.

Features

Key features

Security

Installers created with InnoSetup have vulnerabilities which result in arbitrary code execution and due to their interaction with Windows' user account control additionally in privilege escalation. When run from a user's Downloads directory where an attacker has placed one of the DLLs these installers load per drive-by download this vulnerability results in remote code execution. A proof of concept was published by Stefan Kanthak. [5]

See also

References

  1. ^ Inno Setup License "Inno Setup License". JRSoftware.org. Retrieved 18 January 2010. {{cite web}}: Check |url= value (help)
  2. ^ Why was it created?
  3. ^ "About Inno Setup". JRSoftware.org.
  4. ^ "Inno Setup change log". JRSoftware.org. Retrieved 18 January 2010.
  5. ^ FullDisclosure: Executable installers are vulnerable^WEVIL (case 5): JRSoft InnoSetup
Retrieved from "https://en.wikipedia.org/w/index.php?title=Inno_Setup&oldid=696721346"