Flexera FlexNet Publisher 11.16.2 Command lmadmin.exe unusual condition

Summaryinfo

A vulnerability identified as problematic has been detected in Flexera FlexNet Publisher 11.16.2. The affected element is an unknown function of the file lmadmin.exe of the component Command Handler. Performing a manipulation results in unusual condition. This vulnerability is cataloged as CVE-2019-8960. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Flexera FlexNet Publisher 11.16.2. It has been classified as problematic. This affects some unknown functionality of the file lmadmin.exe of the component Command Handler. The manipulation with an unknown input leads to a unusual condition vulnerability. CWE is classifying the issue as CWE-754. The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product. This is going to have an impact on availability. The summary by CVE is:

A Denial of Service vulnerability related to command handling has been identified in FlexNet Publisher lmadmin.exe version 11.16.2. The message reading function used in lmadmin.exe can, given a certain message, call itself again and then wait for a further message. With a particular flag set in the original message, but no second message received, the function eventually return an unexpected value which leads to an exception being thrown. The end result can be process termination.

The weakness was shared 04/21/2020 (Website). The advisory is shared at community.flexera.com. This vulnerability is uniquely identified as CVE-2019-8960 since 02/20/2019. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entry VDB-154150 is related to this item. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Flexera

Name

• FlexNet Publisher

Version

• 11.16.2

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion