CVE-2021-22038: 
VMware InstallBuilder vulnerability analysis and mitigation

CVE-2021-22038 is a binary planting vulnerability affecting InstallBuilder Windows uninstallers. The vulnerability was discovered and disclosed in October 2021. The issue affects InstallBuilder versions prior to 21.6.0 on Windows systems (InstallBuilder Blog).

The vulnerability occurs when the uninstaller binary copies itself to a fixed temporary location for execution on Windows systems. The temporary location used is not randomized and lacks proper access restrictions to Administrators only. This creates a security weakness in the uninstallation process (InstallBuilder Blog).

If successfully exploited, an attacker could plant a malicious binary to replace the copied uninstaller binary before it gets executed, allowing code execution with the security scope of the uninstaller (InstallBuilder Blog).

The vulnerability was fixed in InstallBuilder version 21.6.0. Affected customers are advised to update to InstallBuilder 21.6.0 or later versions and release new versions of their installers (InstallBuilder Blog).

The vulnerability was discovered and reported by the Lockheed Martin Red Team and Zscaler, who also assisted in testing the fixes (InstallBuilder Blog).