PT-2020-11340 · Flexera · Flexnet Publisher

Published 2020-04-21 · Updated 2020-04-28 · CVE-2019-8960

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FlexNet Publisher lmadmin.exe version 11.16.2

Description A Denial of Service issue has been identified related to command handling. The message reading function in lmadmin.exe can call itself and wait for a further message. If a particular flag is set in the original message but no second message is received, the function returns an unexpected value, leading to an exception and potentially process termination.

Recommendations For FlexNet Publisher lmadmin.exe version 11.16.2, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2019-8960

Affected Products

Flexnet Publisher

References · 3

• https://osv.dev/vulnerability/CVE-2019-8960 · Vendor Advisory
• https://community.flexera.com/t5/FlexNet-Publisher-Knowledge-Base/CVE-2019-8960-remediated-in-FlexNet-Publisher/ta-p/124598/jump-to/first-unread-message · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-8960 · Security Note