Forum Discussion

Andrew Matthews's avatar
Andrew Matthews
Iron Contributor
Jun 27, 2019
Solved

Teams Updater Vulnerability

There are reports circulating that the Teams auto-update process suffers from the same unsigned code execution as other application built with Electron. Running the Update.exe processStart wit...
teams
update
  • John Rea's avatar
    John Rea
    Nov 14, 2019

    This particular squirrel vulnerability was fixed in Teams version 1.2.00.21068.

    Thanks!
    John

gabester's avatar
gabester
Copper Contributor
Jul 02, 2019

This is precisely why enterprise administrators want a standard MSI installer for Teams that puts things into a properly secured location like C:\Program Files location instead of the user's folder. Oh, sure, the vulnerability would still be there but a standard user wouldn't be able to readily leverage it without some other exploit or flaw.

Resources