PT-2023-9837 · Unknown+1 · Flexnet Publisher+1
Xavier Danest
·
Publicado
2023-11-28
·
Atualizado
2025-07-31
·
CVE-2024-2658
CVSS v4.0
8.5
Alta
| Vetor | AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
FlexNet Publisher versions prior to 2024 R1 (11.19.6.0)
Description
A misconfiguration in lmadmin.exe allows the OpenSSL configuration file to load from a non-existent directory. An unauthorized, locally authenticated user with low privileges can potentially create the directory and load a specially crafted openssl.conf file leading to the execution of a malicious DLL with elevated privileges. This issue is related to an uncontrolled search path element, which can be exploited to elevate privileges and execute arbitrary code.
Recommendations
For FlexNet Publisher versions prior to 2024 R1 (11.19.6.0), consider disabling the lmadmin.exe service or restricting access to the directory where the openssl.conf file is loaded until a patch is available. As a temporary workaround, avoid using the lmadmin.exe service until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Uncontrolled Search Path Element
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Flexnet Publisher
Openssl