CVE-2018-20031

Vulnerability

A Denial of Service vulnerability exists in FlexNet Publisher versions 11.16.1.0 and earlier, specifically in the lmgrd and vendor daemon components. The flaw relates to preemptive item deletion, which can be triggered remotely. When a remote attacker sends a specific combination of messages to lmgrd or the vendor daemon, the heartbeat mechanism between lmgrd and the vendor daemon is disrupted, causing the vendor daemon to shut down [1].

Exploitation

An attacker needs network access to the affected FlexNet Publisher components (lmgrd or vendor daemon). No authentication is required; the attacker can send a crafted sequence of messages over the network to exploit the vulnerability. The attack does not require user interaction or privileged access.

Impact

Successful exploitation results in a denial of service condition where the vendor daemon shuts down, disrupting license management services. This can prevent legitimate users from obtaining or renewing software licenses, impacting availability of licensed applications.

Mitigation

As of the advisory publication date (2019-03-21), Flexera recommends upgrading to a version newer than 11.16.1.0. The specific fixed version is not stated in the available reference [1]. No workarounds are mentioned. Users should check with Flexera for the latest patched version.