We are pleased to announce the 2022 R1 Service Pack 1 release for FlexNet Manager for Engineering Applications (FNMEA).   In this release, we've improved the security of the product and upgraded components to address vulnerabilities that have been discovered and published by the security community.   These are the improvements that are part of this release: Implemented HTTP Strict Transport Security (HSTS ) which converts HTTP redirects into HTTPS Upgraded jQuery to version 3.6.0 Upgraded Struts Framework to version 2.5.x Ability to c onfigure SSL on Admin and reporting servers in 2021 Addressed c lickjacking vulnerability in 2021 R1 SP2 Fixed issue with Import package and update data source failing on Linux For more information on the features and enhancements listed above, please refer to the release notes and the updated documentation supplied with this release and available from Flexera Product Documentation.   FlexNet Manager for Engineering Applications release 2022 R1 SP 1 is available for download from the Product and License Center link in the Flexera Community. ... View more

We are pleased to announce the 2022 R1 release for FlexNet Manager for Engineering Applications (FNMEA).   We would like to thank all customers who have provided their valuable feedback to help us focus our efforts on the requirements for this release.   In this release, we've addressed a few of the most requested features/enhancements from customers. This release is also significant in terms of patching some important important vulnerabilities that were discovered and published by the security community in the recent past.   These are the new features/enhancements that are part of this release: Ability to assign levels of importance to alerts Ability for non-admin users to delete their report configurations Command-line options for JFree charts (Classic Reports) These are the components for which security upgrades that were done in the product: Apache Log4J Spring Framework OpenSSL For more information on the features and enhancements listed above, please refer to the release notes and the updated documentation supplied with this release and available from Flexera Product Documentation.   FlexNet Manager for Engineering Applications release 2022 R1 is available for download from the Product and License Center link in the Flexera Community. ... View more

We are pleased to announce the  2021 R1  Service Pack 2 release for FlexNet Manager for Engineering Applications (FNMEA). The primary highlight of the service pack is the upgrtade of Apache Log4j upgraded from 1.x version into latest 2.17.1 version. This upgrade addresses the following vulnerabilities and introduces the latest log4j library support. CVE-2021-45105 CVE-2021-45046 CVE-2021-44228 CVE-2021-44832 In addition to the Log4j upgrade, we have also updated the command line options for Classic Reports that use the new and improved JFree Charts in Service Pack 1. Customers that upgraded to 2021 R1 and have applied the 2021 R 1 Service Pack 1 (and any subsequent hotfixes) are advised to uninstall the service pack and hotfix before applying Service Pack 2. All customers are advised to upgrade to 2021 R1 along with Service Pack 2 to reap the benefits of being on OpenJDK, numerous updated 3rd Party Libraries and an updated Log4J library. FlexNet Manager for Engineering Applications release 2021 R1 Service Pack 2 is available for download from the Product and License Center link in the  Flexera Community . ... View more

Summary A vulnerability has been publicly disclosed in Apache Log4j 1.2. The vulnerability has been assigned the identifier CVE-2021-4104 with a CVSS score of “High”. FlexNet Manager for Engineering Applications versions up to and including 2021 R1 include Log4j 1.2 components, and thus are potentially exposed to this vulnerability. This article describes the potential impact of the vulnerability on FlexNet Manager for Engineering Applications and options for mitigation. Vulnerability description and impact CVE-2021-4104 is described in the CVE List as follows: JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. The default configuration of FlexNet Manager for Engineering Applications does not meet the preconditions described for the vulnerability to be exploited. Mitigation recommendations The following steps should be taken on all computers on which FlexNet Manager for Engineering Applications components are installed: The following mitigation advised by Apache is appropriate to follow: Audit your logging configuration to ensure it has no JMSAppender configured. Logging configuration is stored in files named log4j.xml. Such configuration would be highly unusual for a FlexNet Manager for Engineering Applications installation, and would only appear if a non-default configuration has been applied. Ensure appropriate access controls are in place to ensure only authorized users have access to computers. (This is appropriate to do regardless of the impact from Log4j.) Related information Also see the following pages: The IBM Cognos component included in Flexera Analytics that is used with FlexNet Manager for Engineering Applications is potentially exposed to another Log4j vulnerability. This is discussed on the following page: Flexera Analytics (Cognos) mitigation for Apache Log4j 2 vulnerability CVE-2021-44228 CVE definition: https://nvd.nist.gov/vuln/detail/CVE-2021-4104 Expanded CVE definition: https://www.cve.org/CVERecord?id=CVE-2021-4104 Apache Log4j Security Vulnerabilities page: https://logging.apache.org/log4j/2.x/security.html   ... View more

We are pleased to announce the 2021 R1 release for FlexNet Manager for Engineering Applications (FNMEA).   We would like to thank all customers who have provided their valuable feedback to help us focus our efforts on the requirements for this release.   This release was a major platform upgrade. We have migrated away from Oracle Java to AdoptOpenJDK to eliminate any need for us or our customers to purchase Java SE subscriptions to use the product in a production environment. We have also upgraded several 3rd-party components in the product to more current versions as well to ensure security compliance.   This is a list of the platform and components that have been upgraded: Oracle Java 8 to Adopt OpenJDK 11 Hibernate-ORM from 5.0.10 to 5.4.27 Jboss Server from 8.2 to Wildfly 20.0.1 Spring Framework from 4.3.2 to 5.2.9 Tomcat Library from 8.015 to 9.0.44 Jaxb Library from 2.2.11 to 2.3.1 Proguard Library from 5.2 to 6.2.2 For more information on the features and enhancements listed above, please refer to the release notes and the updated documentation supplied with this release and available from  Flexera Product Documentation .   FlexNet Manager for Engineering Applications release 2021 R1 is available for download from the Product and License Center link in the  Flexera Community . ... View more

Question: What are root access privileges? Answer: The usage ‘root access privileges’ is typically used to refer to permissions given to a username or account that has access to all commands and files on a Linux or other Unix-like operating system. This account is also referred to as the root account, root user or superuser. In a Windows environment, an administrator account holds similar superuser privileges. Question: Are there any risks associated with root access privileges? Answer: Yes, there are risks associated with human users being given root access privileges. They may make mistakes (mistype a powerful command or delete important files) or perform actions with malicious intent. When it comes to programs being given root privilege access in an enterprise environment, organizations usually have an IT security approval process to allow a program to have root privileges if it has been certified and needs the privileges for performing it’s intended functions. Question: Does the Flexera’s inventory solution require root access privileges? Answer: The inventory components of the FlexNet Manager Suite (FNMS) can be implemented in a variety of ways depending on the license compliance and optimization use cases an organization wishes to fulfil and the inventory tools they would like to use to cover those use cases. For basic inventory, the FlexNet Beacon can connect to numerous third-party inventory solutions (like Microsoft SCCM, HP Universal Discovery, etc.) to gather hardware and software inventory required for compliance and optimization. It is also possible to build custom adapters to import data from other third-party tools. For certain specific use cases, where these third-party inventory sources do not provide enough licensing information, the FlexNet Inventory Agent is recommended. The Flexera Inventory Agent is capable of gathering specific inventory details around hardware (like BIOS, UUID details on Linux, MAC address in Solaris, etc.) and software usage tracking for IBM Peak Value Utilization (PVU) and Oracle License Management Services (LMS). The FlexNet Inventory Agent comprises inventory and usage tracking services that require root access privileges to perform deeper inventory for the above-mentioned specific use cases. These privileges are restricted only to the system(s) with the deployed agent(s) or system(s) adopted for zero-footprint agent installation. The FlexNet Beacon and Agent are certified by Veracode (SOC 2 Type II) and the server-side components of the FNMS solution have been certified by WhiteHat.  Question: Can the Flexera Inventory Agent be used without direct root access privileges? Answer: The Flexera Inventory Agent can be run as a non-root account, but it limits the effectiveness of the inventory gathering. For example, running the Agent as a non-root user returns inventory data only for that user’s context based on the permissions that that user has. That said, the Flexera Inventory Agent can also be used in an indirect mode which means that it there is an additional level of control that the customer can exercise over the running of the agent program with root access privileges. You can designate a proxy system/user account (with a setuid operation for xnix) for the Flexera Inventory Agent with the permissions that the customer can provide or revoke as needed You can use a command line interface or scheduler (e.g. cron, etc.) to invoke the Inventory Scanner component (with elevated privileges) as needed You can also use the Flexera Beacon with our ‘Zero Touch’ Agent option along with a High Privilege Access (HPA) management tool like CyberArk which lets you configure access for ‘root’ accounts with access logging. The Flexera Beacon has a built-in integration with CyberArk which allows its password store to provide safe access to remotely install the ‘Zero Touch’ agent to perform inventory. Question: What are some best practices around allowing root access privileges? Answer: When it comes to xnix platforms, we recommend using SELinux or similar technologies which have better controls and constraints placed on user permissions. Question: What are the inventory details that cannot be collected if the Flexera Inventory Agent does not have root access privileges? Without proper root access privileges, the following inventory details cannot be collected: All platforms UNIX-like systems ·   InstallAnywhere, InstallShield Multiplatform, or Oracle Universal Installer evidence under paths not accessible by the executing user ·   Oracle Database service discovery via the local listener using lsnrctl ·   Oracle Database inventory which may use impersonation of an Oracle Database administration user when running the sqlplus command ·   Lack of BIOS serial number which makes computer management quite difficult and usually results in duplicates as machines replaced, migrated etc. ·   File evidence from any file system path not accessible by the executing user   Mac OS X systems Solaris systems ·   Mac OS X package bundle paths under /Applications or /System/Library not accessible by the executing user ·   MAC addresses of network adapters ·   SPARC model using OpenPROM interface HP-UX systems ·   SD-UX installation evidence from swlist if access has been locked down with swreg or swacl ·   vPar evidence including VMType, VMName, and vPar capacity (vparstatus requires root) ·   Hard disk drive properties including capacity ... View more

We are pleased to announce the 2020 R1 release for FlexNet Manager for Engineering Applications (FNMEA). We would like to thank all customers who have provided their valuable feedback to help us focus our efforts on the following features and enhancements: Support for open-source object-relational database PostgreSQL is available for the admin and reporting databases. This will help eliminate the additional cost of obtaining licenses for commercial databases like Microsoft SQL Server or Oracle Database. Support for near real-time log rotation with newly introduced intervals of 1 minute and 30 seconds. This will help have more frequent and fine-grained logging of user license activity. Upgraded analytics and reporting to Cognos 11.0.13 Long-term Support (LTS) version. This will help with better supportability as well as additional features in the version like new base samples, improved drill-through capabilities, etc. Updated support for TLS 1.3 protocol which is faster and more secure FlexNet Manager for Engineering Agent 5.7 is now available for the Solaris 11.x SPARC ‘Duplicates’ and ‘Total Used’ columns added to Usage Summary Report For more information on the features and enhancements listed above, please refer to the release notes and the updated documentation supplied with this release and available from Flexera Product Documentation. FlexNet Manager for Engineering Applications release 2020 R1 is available for download from the Product and License Center link in the Flexera Community. ... View more