CVE-2018-20033

Vulnerability

A remote code execution vulnerability exists in the lmgrd and vendor daemon components of FlexNet Publisher versions 11.16.1.0 and earlier [1]. The flaw occurs when a remote attacker triggers memory corruption by allocating and deallocating memory while loading lmgrd or the vendor daemon, causing the heartbeat signal between lmgrd and the vendor daemon to stop.

Exploitation

An attacker with network access to the affected system can exploit this vulnerability by sending crafted data that manipulates memory allocation and deallocation. This action forces the heartbeat between lmgrd and the vendor daemon to cease, leading to the vendor daemon shutting down. No authentication is required, and no user interaction is needed.

Impact

Successful exploitation could allow the attacker to corrupt memory, potentially leading to remote code execution. The attacker could gain control over the daemon process, compromising the confidentiality, integrity, and availability of the affected system. However, no exploit has been publicly demonstrated as of the publication date.

Mitigation

As of the publication date, no official patch has been released for this vulnerability. Users are advised to monitor vendor advisories for updates and consider restricting network access to the lmgrd and vendor daemon services as a workaround.