FlexNet License Server Manager lmadmin Remote Code Execution Vulnerability

(0day) FlexNet License Server Manager lmadmin Remote Code Execution Vulnerability

Affected Vendor and Product: Flexera Software’s FlexNet License Server Manager

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Flexera Software Flexnet License Server Manager. Authentication is not required to exploit this vulnerability.

The flaw exists within the lmadmin component which listens by default on TCP port 27000 (this can vary however if the port is in use). When handling a packet type having the opcode 0x2f the process trusts a user provided value when calculating the bytes remaining in the packet. Using this tainted remaining length value the process then copies packet data into a buffer on the heap. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the lmadmin user.

Vendor Response

Flexera Software states:

[July 28, 2011] - This vulnerability is being disclosed publicly without a patch in accordance with the ZDI 180 day deadline.

Mitigation supplied by vendor:
This report has been entered into Flexera Softwares technical support case tracking system as IOC-000086525. The FlexNet License Server Manager components (lmgrd, lmadmin, and each vendor daemon) are only intended to be deployed in networks that are controlled by the recipient of FlexNet-enabled software. In particular, they are not intended to be deployed on the internet or in a public cloud. Flexera Software acknowledges that the deployment environments available to the FlexNet License Server Manager components are increasing and Flexera Software is considering supporting new deployment environments for these components in future releases of its products.

Full details here.

Update 2011-08-04: Flexera publishes an IMPORTANT NOTICE: Possible Security Vulnerability Identified in FlexNet Publisher lmadmin License Server Manager

A possible security vulnerability has been reported in the FlexNet Publisher lmadmin License Server Manager. More specifically, it is possible that a malicious user with access to the internal network could remotely execute arbitrary code under the lmadmin user context. In response, we suggest implementing the following best practices. This remains a theoretical vulnerability only. There have been no reported exploits of this possible vulnerability, and to date it has not been reported by a Flexera Software customer.
Flexera Software will provide a patch for all affected lmadmin platforms by August 12, 2011.

Update 2011-08-12:

Hotfix Available for FlexNet Publisher lmadmin License Server Manager
A possible security vulnerability has been identified in the FlexNet Publisher lmadmin License Server Manager.
A hotfix for this has been incorporated into the latest version of lmadmin (version 11.10.0.2). If you are using an earlier version of lmadmin, please use the "lmadmin 11.10.0.2" links below to download the installer(s) for this latest version for your desired platform(s), and follow the instructions in the License Administration Guide to update lmadmin. http://www.globes.com/support/fnp_utilities_download.htm#downloads

See also Potential Security Vulnerability in FlexNet license manager.

FlexNet License Server Manager usage reports can be made with JTB FlexReport.

FlexNet company Flexera Software to be acquired by Teachers’ Private Capital

Three years ago Macrovision Corporation acquired Macrovision’s Software Business Unit. Now it’s time for changes again for the company behind software license manager FlexNet.

Teachers’ Private Capital to Acquire Majority Stake in Flexera Software

SCHAUMBURG, IL (July 19, 2011): Flexera Software, the leading provider of strategic Application Usage Management solutions for application producers and their enterprise customers, today announced that Teachers’ Private Capital, the private investment department of the Ontario Teachers’ Pension Plan, has agreed to acquire a majority stake in Flexera Software from Thoma Bravo, LLC, a private equity firm.

The acquisition is scheduled to close in late September 2011. - press release

Let’s hope that there’s not another name change coming again as it is pretty hard to remember the name of the company behind FlexNet (FLEXlm). Now Flexera Software, before that Acresso Software, Macrovision, GLOBEtrotter and GLOBEtrotter Software and Highland Software.

For FlexNet license reporting tool see JTB FlexReport. With the usage data recorded by JTB FlexReport, reports can be created to easily see how many network licenses are needed.

Autodesk Acquires Pixlr

What is Pixlr? Here’s what that FAQ says: Pixlr is the creator of online cloud-based image tools and utilities. Today we have three applications in our suite: Pixlr Editor, Pixlr Express and Pixlr-o-matic. They are built in Flash and you need to have the Flash plug-in (get flash) to get it to work, however, 98% of all computers have flash so you are probably set. We also provide screengrabbing tools Pixlr Grabber and one click photo sharing imm.io.

Pixlr Editor

Here’s the press release:

Autodesk Acquires Pixlr
Image Services to Strengthen Autodesk Consumer Product Portfolio

SAN RAFAEL, Calif.--(BUSINESS WIRE)--Autodesk, Inc. (NASDAQ:ADSK), a leader in 3D design, engineering and entertainment software, announced today that it has completed the acquisition of Pixlr, a popular free* online and social image creating, collecting, editing and sharing service. Terms of the transaction were not disclosed.

The Pixlr service was started in Sweden in August 2008 and provides accessible tools for non-professionals to create, edit, and share images online and socially via platforms like Facebook. The acquisition enhances Autodesk’s ability to provide image editing for its consumer products, such as the SketchBook product line. As a result of the acquisition, SketchBook Pro desktop users will gain the ability to read and write image file formats such as PXD and to easily exchange files while maintaining deep data such as layers. Current Pixlr users will immediately be able to add more freehand sketching to their projects through file compatibility with Autodesk SketchBook Pro desktop application.

“Lots of people–not just creative professionals—want to express themselves visually,” said Samir Hanna, vice president of Consumer Products at Autodesk. “Combining image editing capabilities with sketching capabilities provides new avenues for rich visual expression. We also intend to marry the Pixlr team’s web development experience with our expertise in mobile app development to help people everywhere be creative on the devices of their choice.”

Pixlr’s founders are now part of Autodesk.

AutoCAD 2012 Performance Slowdown Hotfix

AutoCAD 2012 Performance Slowdown Hotfix (32/64 bit) DL17013122

This hotfix is suitable for all AutoCAD 2012 verticals and will fix the slowdown caused by the layer control update available in the ribbon.

In AutoCAD 2012 versions, mouse cursor freezes during pan or zoom command or when other commands are invoked. Also, general performance slowdown may be experienced. This typically happens if multiple External References (XREF) are attached to the drawing. TS17359616

Applies to:
AutoCAD® 2012
AutoCAD® Architecture 2012
AutoCAD® Civil 3D® 2012
AutoCAD® Electrical 2012
AutoCAD® Map 3D 2012
AutoCAD® Mechanical 2012
AutoCAD® MEP 2012
AutoCAD® Structural Detailing 2012

Autodesk Design Review QuickShare

Autodesk Labs has made QuickShare available at http://quickshare.labs.autodesk.com. When you need to send a dwf file quickly, QuickShare is the answer. No software download required. No account required. Fast viewing of 2D and 3D dwf files right within the browser. When you want to showcase a design on your own website, Quickshare gives you that ability. Upload your design and use the embed tag to place the design and viewer anywhere.

Upload the file.

Share & Embed

And here it is embedded:

(removed as it hanged the browser sometimes)

Or you can click on this link and see the result:

http://quickshare.labs.autodesk.com/adrviewer256874/viewer/index.html?file=/uploads/1f8fbefa2826a33d5a1d2a61cedf3f6b1/manifest.json

System requirements are:

Firefox 4.0 and Higher
Google Chrome
Internet Explorer 9 and Higher (viewing 2D only)
Safari 5 and Higher (viewing 2D only)

 

Visit http://quickshare.labs.autodesk.com for some other samples or try to upload your DWF.

API enhancements for Windows in KB2533623

With this week’s update you may find the Update for Windows 7 for x64-based Systems (KB2533623) and is available for Windows Vista, Windows Server 2008, Windows 7 and Windows Server 2008 R2.

Microsoft has released new API enhancements for Windows to help developers correctly and securely load external libraries. For more information, visit the following Microsoft webpages describing these three APIs.

SetDefaultDllDirectories
Specifies a default set of directories to search when the calling process loads a DLL. This search path is used when LoadLibraryEx is called with no LOAD_LIBRARY_SEARCH flags.

AddDllDirectory
Adds a directory to the process DLL search path.

RemoveDllDirectory
Removes a directory that was added to the process DLL search path by using AddDllDirectory.

Microsoft has also released a Microsoft security advisory about this issue for IT professionals. The security advisory contains additional security-related information. To view the security advisory, visit the following Microsoft website: http://www.microsoft.com/technet/security/advisory/2269637.mspx

Insecure Library Loading Could Allow Remote Code Execution.

The update in Microsoft Knowledge Base Article 2533623 implements Application Programming Interface (API) enhancements in Windows to help developers correctly and securely load external libraries. This update for Windows is available in the "High Priority" Updates category for customers who have not already received the update through automatic updating.

Developers can help to ensure their programs load DLLs properly to avoid "DLL preloading" or "binary planting" attacks by following the guidance provided in Microsoft Knowledge Base Article 2533623 to take advantage of the API enhancements provided by this update.

Windows Live Essentials 2011 build 15.4.3538.0513

Inside Windows Live informs about the new Windows Live Essentials 2011 build 15.4.3538.0513 released 2011-07-06 and you can get it at http://explore.live.com right now.

Here are a few things mentioned:

• Mail: We fixed a sorting issue in the Sent items folder and improved the upload reliability and instrumentation in Photo mail.
• Messenger: We fixed a couple of stability issues and made various changes for improved voice and video quality. We fixed an issue that was causing sound to be lost after upgrading, and we improved performance when displaying the MSN Today page in the main window.
• Photo Gallery: We implemented various bug fixes for crashes related to launching Photo Gallery through Autoplay and facial recognition.
• And more: We made many other usability, performance, and stability improvements across the suite of Windows Live Essentials apps.

Unfortunately these other bugs are not fixed yet: Windows Live Writer 2011 picture quality bug and Windows Live Writer 2011 bug and wish.

I had to uninstall the previous version of Windows Live Essentials 2011 due to some problem with Windows Live ID Sign-in Assistant and then I had to restart before succeeding.

If you get this error it might help to just restart the computer: Windows Live Essentials couldn’t be installed. It looks like another program is preventing the installer from working. Error: 0x80070643 Source: wllogin-amd64

Do you have Ideas for AutoCAD?

Between the Lines informs about what you can do with your ideas.

“The AutoCAD Product Design Team has a new experimental web based site launched to gather more of your ideas and rank them by your voting. Go submit some of your ideas on new features and changes to existing ones. You can also view and vote on other submitted ideas to help shape the future of AutoCAD.”

Go to http://autode.sk/kXmZU4 to submit and vote for ideas to improve your experience using AutoCAD!

Google moderator is used for this purpose and I might use it myself for some future projects.

Office 2010 Service Pack 1 Error 0x8024002D

Office 2010 Service Pack 1 (SP1) is now available and when I installed it via Windows Update I got the error 0x8024002D. First time it just failed to install. I then tried again and got a dialog box asking for an MSI file so I browsed for it. Still it didn’t work so I tried again and got asked about another MSI file. After a few tries it finally worked out. Problem solved.

(Checking the log file in %TEMP% I saw this: Error 1706. Setup cannot find the required files.  Check your connection to the network, or CD-ROM drive.    For other potential solutions to this problem, see SETUP.CHM.")

Strange that the files could not be found because they were available. I had them on an external hard drive, maybe that confused the installer.

This KB article might otherwise help.

On the topic I found that I had to rebuild the whole Index, something I’m not so happy about.

Here are some highlights of SP1:

Excel 2010 SP1 Improves the overall stability, performance and backward compatibility with earlier versions by addressing bugs that affect lots of users.

Outlook 2010 SP1 includes Office 365 support.

Outlook 2010 SP1 can be set to always use the default sending account.

Outlook 2010 SP1 Fixes an issue in which the snooze time does not between appointments.

PowerPoint 2010 SP1 The default behavior for the Use Presenter View option is changed to display the slide show on the secondary monitor, and display the notes on the primary monitor.

For complete list of improvements see this KB article including details for Word 2010 SP1 and OneNote 2010 SP1.

Sheet Set Manager performance issue with Windows 2008 R2 server with SMB V2 active

This is for users of AutoCAD or any AutoCAD vertical together with Sheet Set Manager (SSM) having DWG files stored in a Windows 2008 R2 server with SMB V2 active. It seems to be unrelated to the AutoCAD version. Should affect AutoCAD LT 2012 too.

As soon we open a Sheet Set from the server, Process Explorer shows that the process AdcomFolderWatch.dll uses until 50% CPU utilization, and the Network traffic goes up and stays at ~5 Mbps, even after closing all drawings in AutoCAD).

This issue only affects the systems having SMB Ver.2 active, like Windows 2008 Server R2.

The Autodesk development team is working actively in trying to fix this issue, but for instance, the only way to avoid it is to enable SMB 1. See How to Disable SMB 2.0 on Windows Vista/2008

Via Up and Ready

See also Slow Sheet Set Manager solution and Sheet Set Manager performance tips as well as the Sheet Set Manager Editor SSMPropEditor.

Autodesk Infrastructure Design Suite Network License Hotfix

Autodesk Infrastructure Design Suite Network License Hotfix

In a continued effort to improve, we are releasing this hotfix for network license environments where both AutoCAD Civil 3D and Autodesk Infrastructure Design Suite Premium or Ultimate license exist.

This hotfix addresses a possible issue with AutoCAD Civil 3D 2012 pulling the incorrect license at launch.  This hotfix should be applied to all machines that have AutoCAD Civil 3D 2012 installed, regardless of whether it was installed as part of a suite or as a point products (not part of a suite).

Download at DL17253046

For more information on how AutoCAD Civil 3D 2012 pulls network licenses in a mixed license environment, please see the following solutions. Understanding a Civil 3D and Infrastructure Suite mixed license environment and 2012: Cascading Sequences for Autodesk Products

Understanding a Civil 3D and Infrastructure Suite mixed license environment

Issue:

You have a mixture of Civil 3D network licenses and Infrastructure Suite Premium or Ultimate network licenses and you are wondering which license AutoCAD Civil 3D 2012 will pull first.

Solution:

It does not matter if AutoCAD Civil 3D 2012 was installed as part of one of the Autodesk Infrastructure Design Suites or as a point product (not as part of the suite). When you have a mixed license environment, AutoCAD Civil 3D 2012 will always look to pull a Civil 3D license first. If no Civil 3D licenses are available, it will then look to pull an Infrastructure Design Suite Premium or Ultimate license.

The following diagram shows this sequencing:

In the event that you first pull a Civil 3D network license and later, while that license is still in use, you pull one of the Infrastructure Design Suite licenses by launching a different product in that suite, the Civil 3D license will be returned and you will only consume the one suite license. The same thing applies if you first pull a suite license and then launch AutoCAD Civil 3D 2012.

Note: To allow this expected behavior, you must first apply the Autodesk Infrastructure Design Suite Network License Hotfix to the machine running AutoCAD Civil 3D 2012.

For License Statistics monitoring See JTB FlexReport.

AutoCAD 2012 Hotfix solving Block Editor Save Corruption

Autodesk 2012 Block Editor Save Corruption Hot Fix

This hotfix prevents possible loss of data that may occur if the drawing is saved while the Block Editor is open in AutoCAD® 2012-based products as well as AutoCAD LT 2012.

What might happen is that the complete drawing is replaced with the edited block.

Get the download of AcAuthEnviron.arx at DL17244799

Description of Problem

When a drawing is saved from within the Block Editor, the entire content of the drawing is sometimes lost and replaced with the content of the block being edited.

Affected Products

• AutoCAD 2012
• AutoCAD Architecture 2012
• AutoCAD Civil 3D^® 2012
• AutoCAD Electrical 2012
• AutoCAD Land Desktop 2012
• AutoCAD LT^® 2012
• AutoCAD Map3D 2012
• AutoCAD Mechanical 2012
• AutoCAD MEP 2012
• AutoCAD P&ID 2012

How to specify the port to be used by FlexNet license manager

If you don't specifically add the TCP/IP port number to the license file it can change. When checking the network license usage status with JTB FlexReport you can find this error for example in the HTML report:

Error getting status: Cannot connect to license server system. (-15,10:10061 "WinSock: Connection refused")

Typically this does not happen if you have one license file  on the server but if you have several vendor daemons the port number can be switched depending on what order the services are started. This can result in that the data stops being logged to the database and that the HTML reports does not show the current usage. It’s recommended that you enter the port to the license file it it’s not already there. To find the current used port you can use lmtools.exe and check for it using Perform Status Enquiry. See How to find the port used by a FlexNet license service.

The format of the SERVER line in the license file is:

SERVER host hostid [port]

Example:

SERVER my_server 17007ea8 27000

or

SERVER my_server 17007ea8 TCP:27000

It is recommended to use a port number in this range: 27000-27009.

Use lmtools.exe and stop and start the service.

If you for some reason would want to change the port used by the vendor daemon it is also possible to do in the license file. But it is strongly recommended to leave it as it is.

For example in an Autodesk license file it can look like this, just change 2080:

VENDOR adskflex port=2080

How to find the port used by a FlexNet license service

When you configure JTB FlexReport to monitor FlexNet/FLEXlm licensed applications you need to specify the port and server in JTB FlexReport Config > Properties > FlexNet > License to report on.

Click on Find button and see if the server(s) can be found automatically.

If nothing is found the information needs to be added manually.

The format is port@server and if there are multiple distributed servers separate with semicolon like this: port@server1;port@server2. If you have redundant or triad servers separate them with commas like this: port@serverA,port@serverB,port@serverC. If there is a mix of setups it can look like this: port@server1;port@server2;port@serverA,port@serverB,port@serverC;port@server3

If you don’t know the port number one way is to run LMTOOLS.EXE on the license server. If you have multiple services select the one you’re interested in first and then click on the Server Status tab.

Click on Perform Status Enquiry and take note of the port that is found on the row starting with License server status. In the example below the port is 27000.

It is also possible to monitor usage across domains.

Here is a description one customer provided.

I was trying to get JTB to watch a Flexlm Server that was in another domain.  In order to get DNS to resolve the IP address of the server in the other domain I have to enter a fully qualified name.  So for example in order to get a successful ping response I had to use the following format:  ping <Server Name>.<Domain Name>.<Domain Extension>.  So I thought the following format would work in the JTB “Licenses to report on” list:  <port number>@<Server Name>.<Domain Name>.<Domain Extension>.  For example: 27000@server1.mydomain.com  This did appear to work, partially.  If I looked in the JTBFlexReportDebug.log I would see an entry like this:

lmutil - Copyright (c) 1989-2009 Acresso Software Inc. All Rights Reserved.
Flexible License Manager status on Thu 5/12/2011 10:26
[Detecting lmgrd processes...]
License server status: 27000@server1
     License file(s) on server1: 27000@123.123.12.12:
lmgrd is not running: License server machine is down or not responding. (-96,7:11004 "WinSock: Valid name, but no record (NO_ADDRESS)")

Notice how it does initially resolve the name to an IP address but the name listed has the fully qualified domain info truncated off the end.  Apparently lmutil initially uses the fully qualified name, then at some point it trims off the domain info.  Well I found a post where some other guy was getting this error when he was trying to run the lmutil lmstat command line utility.  What he did to resolve the problem was he added entries into his “C:\WINDOWS\system32\drivers\etc\hosts” file for the non fully qualified name.

127.0.0.0 localhost
123.123.12.12 server1

Once you do this lmutil will be able to successfully run an lmstat command on these servers.  A better solution would be to add a DNS alias.

Another customer came with these details:

If the client PC is far a way from FLEXlm server, like the PC is in South America and server is in Europe. PC and server have a machine account in company wide Active Directory Each continent has separate domain name like European computers are in domain eu.net and American am.net.
Try to list all licenses from server (change the port and server name to yours)
lmutil.exe lmstat -c 27000@server.eu.net –a

Result:
lmgrd is not running: License server machine is down or not responding. (-96,7:11001 "WinSock: Host not found (HOST_NOT_FOUND)")

Add IP address and host name of the server to C:\WINDOWS\system32\drivers\etc\hosts
123.123.123.123 server server.eu.net

Now run the same command without domain name
lmutil.exe lmstat -c 27000@server -a
Now it works! Autodesk products get the license without hosts modification but lmutil.exe fails badly. Some error in DNS configuration? I don't know but if the PC is in Europe both commands will work because the both computers are in the same domain.

Use of timeout

Usage of -t for timeout with lmutil.exe lmstat can be done through JTB FlexReport Config>Properties>Advanced.

If data is missing or license servers cannot be reached you can try to set the timeout to something. It’s not documented by the company behind FlexNet if this is in microseconds or milliseconds so you have to try. It is probably microseconds so a value of 1,000,000 would be a second.

-15,10:10060 "WinSock: Connection timed out

Error getting status: Cannot connect to license server system. (-15,10:10060 "WinSock: Connection timed out")

Solution is probably to open any of the ports being used.

How to check if port is open

See this post How to check if ports used for licensing are open or use telnet to test if a port is open.