PT-2020-11341 · Flexera · Flexnet Publisher

Published 2020-04-21 · Updated 2021-07-21 · CVE-2019-8961

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FlexNet Publisher lmadmin.exe version 11.16.2

Description A Denial of Service issue related to stack exhaustion has been identified. The message reading function calls itself recursively under certain conditions in the received message, allowing an unauthenticated remote attacker to cause a stack exhaustion condition by repeatedly sending specific messages.

Recommendations For version 11.16.2, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2019-8961

Affected Products

Flexnet Publisher

References · 3

• https://community.flexera.com/t5/FlexNet-Publisher-Knowledge-Base/CVE-2019-8961-remediated-in-FlexNet-Publisher/ta-p/124601/jump-to/first-unread-message · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-8961 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-8961 · Security Note