PT-2019-3826 · Flexnet · Flexnet Publisher

Published 2019-02-25 · Updated 2022-04-18 · CVE-2018-20033

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FlexNet Publisher versions 11.16.1.0 and earlier

Description A Remote Code Execution issue in the lmgrd and vendor daemon components could allow a remote attacker to corrupt memory by allocating or deallocating memory, which can cause the heartbeat between lmgrd and the vendor daemon to stop, forcing the vendor daemon to shut down. This issue is related to the ability to damage memory when allocating or deallocating it.

Recommendations For FlexNet Publisher versions 11.16.1.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Allocation of Resources Without Limits

Buffer Overflow

Weakness Enumeration

CWE-770

CWE-119

Related Identifiers

BDU:2019-04185

CVE-2018-20033

Affected Products

Flexnet Publisher

References · 7

• https://secuniaresearch.flexerasoftware.com/advisories/85979 · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2021.html · Patch
• https://osv.dev/vulnerability/CVE-2018-20033 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20033 · Security Note
• https://bdu.fstec.ru/vul/2019-04185 · Security Note
• https://schneider-electric.com/en/download/document/SEVD-2019-134-04 · Note
• http://securityfocus.com/bid/109155 · Note