FlexNet License Server Manager lmadmin Remote Code Execution Vulnerability

(0day) FlexNet License Server Manager lmadmin Remote Code Execution Vulnerability

Affected Vendor and Product: Flexera Software’s FlexNet License Server Manager

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Flexera Software Flexnet License Server Manager. Authentication is not required to exploit this vulnerability.

The flaw exists within the lmadmin component which listens by default on TCP port 27000 (this can vary however if the port is in use). When handling a packet type having the opcode 0x2f the process trusts a user provided value when calculating the bytes remaining in the packet. Using this tainted remaining length value the process then copies packet data into a buffer on the heap. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the lmadmin user.

Vendor Response

Flexera Software states:

[July 28, 2011] - This vulnerability is being disclosed publicly without a patch in accordance with the ZDI 180 day deadline.

Mitigation supplied by vendor:
This report has been entered into Flexera Softwares technical support case tracking system as IOC-000086525. The FlexNet License Server Manager components (lmgrd, lmadmin, and each vendor daemon) are only intended to be deployed in networks that are controlled by the recipient of FlexNet-enabled software. In particular, they are not intended to be deployed on the internet or in a public cloud. Flexera Software acknowledges that the deployment environments available to the FlexNet License Server Manager components are increasing and Flexera Software is considering supporting new deployment environments for these components in future releases of its products.

Full details here.

Update 2011-08-04: Flexera publishes an IMPORTANT NOTICE: Possible Security Vulnerability Identified in FlexNet Publisher lmadmin License Server Manager

A possible security vulnerability has been reported in the FlexNet Publisher lmadmin License Server Manager. More specifically, it is possible that a malicious user with access to the internal network could remotely execute arbitrary code under the lmadmin user context. In response, we suggest implementing the following best practices. This remains a theoretical vulnerability only. There have been no reported exploits of this possible vulnerability, and to date it has not been reported by a Flexera Software customer.
Flexera Software will provide a patch for all affected lmadmin platforms by August 12, 2011.

Update 2011-08-12:

Hotfix Available for FlexNet Publisher lmadmin License Server Manager
A possible security vulnerability has been identified in the FlexNet Publisher lmadmin License Server Manager.
A hotfix for this has been incorporated into the latest version of lmadmin (version 11.10.0.2). If you are using an earlier version of lmadmin, please use the "lmadmin 11.10.0.2" links below to download the installer(s) for this latest version for your desired platform(s), and follow the instructions in the License Administration Guide to update lmadmin. http://www.globes.com/support/fnp_utilities_download.htm#downloads

See also Potential Security Vulnerability in FlexNet license manager.

FlexNet License Server Manager usage reports can be made with JTB FlexReport.

FlexNet company Flexera Software to be acquired by Teachers’ Private Capital

Three years ago Macrovision Corporation acquired Macrovision’s Software Business Unit. Now it’s time for changes again for the company behind software license manager FlexNet.

Teachers’ Private Capital to Acquire Majority Stake in Flexera Software

SCHAUMBURG, IL (July 19, 2011): Flexera Software, the leading provider of strategic Application Usage Management solutions for application producers and their enterprise customers, today announced that Teachers’ Private Capital, the private investment department of the Ontario Teachers’ Pension Plan, has agreed to acquire a majority stake in Flexera Software from Thoma Bravo, LLC, a private equity firm.

The acquisition is scheduled to close in late September 2011. - press release

Let’s hope that there’s not another name change coming again as it is pretty hard to remember the name of the company behind FlexNet (FLEXlm). Now Flexera Software, before that Acresso Software, Macrovision, GLOBEtrotter and GLOBEtrotter Software and Highland Software.

For FlexNet license reporting tool see JTB FlexReport. With the usage data recorded by JTB FlexReport, reports can be created to easily see how many network licenses are needed.

Autodesk Acquires Pixlr

What is Pixlr? Here’s what that FAQ says: Pixlr is the creator of online cloud-based image tools and utilities. Today we have three applications in our suite: Pixlr Editor, Pixlr Express and Pixlr-o-matic. They are built in Flash and you need to have the Flash plug-in (get flash) to get it to work, however, 98% of all computers have flash so you are probably set. We also provide screengrabbing tools Pixlr Grabber and one click photo sharing imm.io.

Pixlr Editor

Here’s the press release:

Autodesk Acquires Pixlr
Image Services to Strengthen Autodesk Consumer Product Portfolio

SAN RAFAEL, Calif.--(BUSINESS WIRE)--Autodesk, Inc. (NASDAQ:ADSK), a leader in 3D design, engineering and entertainment software, announced today that it has completed the acquisition of Pixlr, a popular free* online and social image creating, collecting, editing and sharing service. Terms of the transaction were not disclosed.

The Pixlr service was started in Sweden in August 2008 and provides accessible tools for non-professionals to create, edit, and share images online and socially via platforms like Facebook. The acquisition enhances Autodesk’s ability to provide image editing for its consumer products, such as the SketchBook product line. As a result of the acquisition, SketchBook Pro desktop users will gain the ability to read and write image file formats such as PXD and to easily exchange files while maintaining deep data such as layers. Current Pixlr users will immediately be able to add more freehand sketching to their projects through file compatibility with Autodesk SketchBook Pro desktop application.

“Lots of people–not just creative professionals—want to express themselves visually,” said Samir Hanna, vice president of Consumer Products at Autodesk. “Combining image editing capabilities with sketching capabilities provides new avenues for rich visual expression. We also intend to marry the Pixlr team’s web development experience with our expertise in mobile app development to help people everywhere be creative on the devices of their choice.”

Pixlr’s founders are now part of Autodesk.

AutoCAD 2012 Performance Slowdown Hotfix

AutoCAD 2012 Performance Slowdown Hotfix (32/64 bit) DL17013122

This hotfix is suitable for all AutoCAD 2012 verticals and will fix the slowdown caused by the layer control update available in the ribbon.

In AutoCAD 2012 versions, mouse cursor freezes during pan or zoom command or when other commands are invoked. Also, general performance slowdown may be experienced. This typically happens if multiple External References (XREF) are attached to the drawing. TS17359616

Applies to:
AutoCAD® 2012
AutoCAD® Architecture 2012
AutoCAD® Civil 3D® 2012
AutoCAD® Electrical 2012
AutoCAD® Map 3D 2012
AutoCAD® Mechanical 2012
AutoCAD® MEP 2012
AutoCAD® Structural Detailing 2012

Autodesk Design Review QuickShare

Autodesk Labs has made QuickShare available at http://quickshare.labs.autodesk.com. When you need to send a dwf file quickly, QuickShare is the answer. No software download required. No account required. Fast viewing of 2D and 3D dwf files right within the browser. When you want to showcase a design on your own website, Quickshare gives you that ability. Upload your design and use the embed tag to place the design and viewer anywhere.

Upload the file.

Share & Embed

And here it is embedded:

(removed as it hanged the browser sometimes)

Or you can click on this link and see the result:

http://quickshare.labs.autodesk.com/adrviewer256874/viewer/index.html?file=/uploads/1f8fbefa2826a33d5a1d2a61cedf3f6b1/manifest.json

System requirements are:

Firefox 4.0 and Higher
Google Chrome
Internet Explorer 9 and Higher (viewing 2D only)
Safari 5 and Higher (viewing 2D only)

 

Visit http://quickshare.labs.autodesk.com for some other samples or try to upload your DWF.

API enhancements for Windows in KB2533623

With this week’s update you may find the Update for Windows 7 for x64-based Systems (KB2533623) and is available for Windows Vista, Windows Server 2008, Windows 7 and Windows Server 2008 R2.

Microsoft has released new API enhancements for Windows to help developers correctly and securely load external libraries. For more information, visit the following Microsoft webpages describing these three APIs.

SetDefaultDllDirectories
Specifies a default set of directories to search when the calling process loads a DLL. This search path is used when LoadLibraryEx is called with no LOAD_LIBRARY_SEARCH flags.

AddDllDirectory
Adds a directory to the process DLL search path.

RemoveDllDirectory
Removes a directory that was added to the process DLL search path by using AddDllDirectory.

Microsoft has also released a Microsoft security advisory about this issue for IT professionals. The security advisory contains additional security-related information. To view the security advisory, visit the following Microsoft website: http://www.microsoft.com/technet/security/advisory/2269637.mspx

Insecure Library Loading Could Allow Remote Code Execution.

The update in Microsoft Knowledge Base Article 2533623 implements Application Programming Interface (API) enhancements in Windows to help developers correctly and securely load external libraries. This update for Windows is available in the "High Priority" Updates category for customers who have not already received the update through automatic updating.

Developers can help to ensure their programs load DLLs properly to avoid "DLL preloading" or "binary planting" attacks by following the guidance provided in Microsoft Knowledge Base Article 2533623 to take advantage of the API enhancements provided by this update.

Windows Live Essentials 2011 build 15.4.3538.0513

Inside Windows Live informs about the new Windows Live Essentials 2011 build 15.4.3538.0513 released 2011-07-06 and you can get it at http://explore.live.com right now.

Here are a few things mentioned:

• Mail: We fixed a sorting issue in the Sent items folder and improved the upload reliability and instrumentation in Photo mail.
• Messenger: We fixed a couple of stability issues and made various changes for improved voice and video quality. We fixed an issue that was causing sound to be lost after upgrading, and we improved performance when displaying the MSN Today page in the main window.
• Photo Gallery: We implemented various bug fixes for crashes related to launching Photo Gallery through Autoplay and facial recognition.
• And more: We made many other usability, performance, and stability improvements across the suite of Windows Live Essentials apps.

Unfortunately these other bugs are not fixed yet: Windows Live Writer 2011 picture quality bug and Windows Live Writer 2011 bug and wish.

I had to uninstall the previous version of Windows Live Essentials 2011 due to some problem with Windows Live ID Sign-in Assistant and then I had to restart before succeeding.

If you get this error it might help to just restart the computer: Windows Live Essentials couldn’t be installed. It looks like another program is preventing the installer from working. Error: 0x80070643 Source: wllogin-amd64