CVE-2018-20034

Vulnerability

A Denial of Service vulnerability exists in FlexNet Publisher version 11.16.1.0 and earlier. The flaw occurs in the lmgrd and vendor daemon components when processing a specific combination of messages related to adding an item to a list, causing the heartbeat between lmgrd and the vendor daemon to stop.

Exploitation

An attacker can send a crafted combination of messages remotely without authentication. The attack does not require any special privileges or user interaction. The attacker must be able to communicate with the lmgrd or vendor daemon network service.

Impact

Successful exploitation causes the vendor daemon to shut down, resulting in a denial of service. This prevents legitimate users from obtaining licenses managed by FlexNet Publisher.

Mitigation

Flexera has not released a patch as of the publication date (2019-03-21). Users should upgrade to a version newer than 11.16.1.0 if available, or apply network access controls to limit exposure to trusted hosts only [1].