CVE-1999-1054: Medium severity globetrotter flexlm vulnerability
The default configuration of FLEXlm license manager 6.0d, and possibly other versions, allows remote attackers to shut down the server via the lmdown command.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the license manager configuration to prevent the lmdown command from being invoked remotely — disable remote lmdown execution or restrict it to local interfaces only.
FlexNet Publisher (FLEXlm) license manager remote lmdown command execution = disabled or restricted to localhost - Compensating control
Restrict network access to the FLEXlm license manager service/ports to trusted hosts only (firewall, ACLs, or network segmentation) to prevent remote attackers from reaching the lmdown functionality.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1054?
CVE-1999-1054 has been classified with a high severity rating due to the potential for remote attackers to disrupt service.
How do I fix CVE-1999-1054?
To fix CVE-1999-1054, it's recommended to review and modify the FLEXlm license manager's default configuration to restrict access to the lmdown command.
What versions are affected by CVE-1999-1054?
CVE-1999-1054 specifically affects version 6.0d of FLEXlm license manager, and potentially other versions.
Can CVE-1999-1054 be exploited remotely?
Yes, CVE-1999-1054 can be exploited remotely, allowing attackers to shut down the server using the lmdown command.
What impact does CVE-1999-1054 have on FlexNet Publisher?
CVE-1999-1054 allows unauthorized users to disrupt service by shutting down the FLEXlm license manager server.