CVE-2024-2658

Name of the Vulnerable Software and Affected Versions FlexNet Publisher versions prior to 2024 R1 (11.19.6.0)

Description A misconfiguration in the lmadmin.exe executable allows the OpenSSL configuration file to be loaded from a non-existent directory. This issue, categorized as an Uncontrolled Search Path Element, occurs because the application references the OpenSSL configuration file using a hardcoded path without enforcing access restrictions. A locally authenticated user with low privileges can create the missing directory and place a specially crafted openssl.conf file within it. This can lead to the loading of a malicious DLL (Dynamic-Link Library) into the lmadmin.exe process, resulting in arbitrary code execution with elevated privileges, potentially reaching the NT AUTHORITYSYSTEM level. This flaw has been reported as actively exploited in the wild.

Recommendations Update FlexNet Publisher to version 2024 R1 (11.19.6.0) or later.