CVE-2018-20033
highPriorität · verfolgen · 40EPSS 0.037 · 90. PerzentilEURUUSEPSS · bewertet 2026-10-27
A Remote Code Execution vulnerability in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier could allow a remote attacker to corrupt the memory by allocating / deallocating memory, loading lmgrd or the vendor daemon and causing the heartbeat between lmgrd and the vendor daemon to stop. This would force the vendor daemon to shut down. No exploit of this vulnerability has been demonstrated.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenFloating License Managercisa_csaf_ot
Schneider Electric recommends users upgrade to Floating License Manager (FLM) Version 2.3.1.0 as soon as possible.
- BehobenFlexNet Publishercisa_csaf_ot
Flexera recommends all users using affected versions of FlexNet Publisher upgrade to Version 2018 R4 or newer as soon as possible. The updates can be obtained with a customer account at the following location (login required):
https://flexerasoftware.flexnetoperations.com/control/inst/login?nextURL=%2Fcontrol%2Finst%2Findex - MitigationVijeo Citect and Citect SCADA Floating License Managercisa_csaf_ot
AVEVA states that users who have deployed Floating License Manager Version 2.3.0.0 and earlier to manage their Software Licensing for Vijeo Citect or Citect SCADA (Version 7.30 and later) could be impacted.
- MitigationFloating License Managercisa_csaf_ot
Schneider Electric has made a fix for these vulnerabilities available for download on its website
https://www.schneider-electric.com/en/download/document/FLM_V2.3.1.0/ - MitigationFlexNet Publishercisa_csaf_ot
More information on this issue can be found at the following location on the Flexera site:
https://community.flexera.com/t5/FlexNet-Publisher-News/FlexNet-Publisher-2018-R4-SP1-is-now-available/ba-p/95063/jump-to/first-unread-message
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 7.5–9.8
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (21)
Betroffene Produkte und Versionsbereiche.
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- ICSA-19-192-05AVEVA Vijeo Citect and Citect SCADA Floating License Manager2019-07-11icsa · cisa_csaf_otUS
These vulnerabilities could allow an attacker to deny the acquisition of a valid license for legal use of the product.
- ICSA-19-192-07Schneider Electric Floating License Manager2019-07-11icsa · cisa_csaf_otUS
These vulnerabilities could allow an attacker to deny the acquisition of a valid license for legal use of the product.
- ICSA-19-323-01Flexera FlexNet Publisher2019-11-19icsa · cisa_csaf_otUS
These vulnerabilities could allow an attacker to deny the acquisition of a valid license for legal use of the product. The memory corruption vulnerability could allow remote code execution.
auch bekannt als (5)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (21)
Externe Belege — Patches, Meldungen, Analysen.
- http://www.ibm.com/support/docview.wsscnnvd
- http://www.ibm.com/support/docview.wss?uid=ibm10879027cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2018-20033cnnvd
- https://secuniaresearch.flexerasoftware.com/advisories/85979/cnnvd
- https://support.citrix.com/article/CTX261963cnnvd
- https://www.auscert.org.au/bulletins/78450cnnvd
- https://www.auscert.org.au/bulletins/ESB-2019.2582/cnnvd
- https://www.auscert.org.au/bulletins/ESB-2019.3621/cnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan