A potential vulnerability exists in FlexNet inventory agent and inventory beacon versions 2022 R2.3 Part Number: 19.3.0 and earlier installations on Unix-like platforms devices running Docker daemon containers. The vulnerability may potentially allow a privilege escalation.
To address the potential vulnerability, the security update IOK-1085727 for the FlexNet inventory agent and inventory beacon version 2022 R2.4 Part Number: 19.4.0 were released.
Applies to
FlexNet inventory agent and inventory beacon versions prior to 19.4.0 for Unix-like platforms used by Flexera One IT Asset Management, IT Visibility, and FlexNet Manager Suite on-premises.
CVE Identifier
Exploitability Assessment
Publicly disclosed? No.
Exploited? No known exploits.
Rating
The potential vulnerability has been rated with a CVSS (Common Vulnerability Scoring System) version 3.1 base score of 7.8.
CVSS version 3.1 and its automatic scoring calculation based on the CVSS metrics are known to have scaling issues, such that potential vulnerabilities frequently end up in the higher-scoring brackets.
Flexera’s internal vulnerability analysis and assessment team, Secunia Research, assigned a criticality rating of “Less Critical”, which is the second lowest Secunia Research criticality rating on a scale of 5 criticality ratings (from “Not Critical” through “Extremely Critical”).
Flexera has released an update to address the security vulnerability. We recommend upgrading the FlexNet inventory agent and inventory beacon versions 2022 R2.3 Part Number: 19.3.0 and earlier to version 2022 R2.4 Part Number: 19.4.0 or later.
Download the updated FlexNet inventory agent and inventory beacon version 2023 R1 or later, available through the Product and License Center. We recommend upgrading to the latest version of the FlexNet inventory agent and inventory beacon for FlexNet Manager Suite.
NOTE: The FlexNet inventory agent and inventory beacon update packages are designed to be compatible with the operating systems and architecture versions still supported. See the FlexNet Manager Suite Lifecycle Timeline to see which versions are supported.
Where to deploy
FlexNet inventory agent for Unix-like platforms and inventory beacon update IOK-1085727 must be deployed on the web application server and inventory server.
Single server implementation
Multi-server implementation
Your beacon upgrading steps depend on your current settings.
To verify your beacon upgrade settings:
FlexNet Manager Suite
Flexera One
FlexNet Manager Suite
Flexera One
NOTE: The FlexNet inventory agent security update is for the FlexNet inventory agent for Unix-like platforms. Inventory agent and inventory beacon version 19.4.0 and later are compatible with earlier supported versions of FlexNet Manager Suite. FlexNet inventory agent and beacon versions earlier than version 19.4.0 have been deprecated. See the FlexNet Manager Suite Lifecycle Timeline to see which versions are supported.
NOTE: Flexera One ITAM and FlexNet Manager Suite don’t support automatic upgrading of the Flexera inventory agent for Debian Linux.
If you decide to upgrade an inventory beacon manually, disable the inventory beacon auto-upgrade through the beacon properties first. If you don't modify the settings for automatic upgrades, the next update of the beacon policy reverts the inventory beacon back to the previous setting.
Regardless of the limited vector the potential vulnerability provides, basic security best practices in conjunction with the FlexNet inventory agent and inventory beacon installation and use should be followed.
This vulnerability can be mitigated by including the following folder in the list of excluded file evidence folders for Linux/UNIX operating systems:
To exclude the file evidence folder:
on
Dec 01, 2023
03:06 AM
- edited on
May 10, 2024
02:03 PM
by
HollyM