SB2019032118 - Input validation error in Floating License Manager

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019032118

SB2019032118 - Input validation error in Floating License Manager

Published: March 21, 2019 Updated: July 12, 2019

Security Bulletin ID SB2019032118
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Input validation error (CVE-ID: CVE-2018-20032)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input related to message decoding in lmadmin and vendor daemon components. A remote attacker can send a combination of messages to lmadmin or the vendor daemon, causing the heartbeat between lmadmin and the vendor daemon to stop and the vendor daemon to shut down.


Remediation

Install update from vendor's website.

References