Please be aware not all mitigations apply to every possible product configuration, so please check which of these could be relevant or applicable.
The following measures are recommended to reduce the risk until the fixed version can be installed. Update to the latest version of the CodeMeter Runtime.Jokūbas Arsoba reported this vulnerability to Wibu-Systems. CRITICAL INFRASTRUCTURE SECTORS: Multiple.A CVSS v3 base score of 7.1 has been assigned the CVSS vector string is ( AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). This could result in overwriting of essential files or a crash of the CodeMeter Runtime Server.ĬVE-2021-41057 has been assigned to this vulnerability. CodeMeter Runtime: All versions prior to Version 7.30aģ.2 VULNERABILITY OVERVIEW 3.2.1 IMPROPER PRIVILEGE MANAGEMENT CWE-269Ī local attacker using the Microsoft Windows OS could cause CodeMeter Runtime to improperly control file access permissions by setting up a link to a special system file used with CmDongles.The following versions of CodeMeter Runtime, a license manger, are affected:
Successful exploitation of this vulnerability could allow an attacker to crash the CodeMeter Runtime Server, which could cause a denial-of-service condition.
Vulnerability: Improper Privilege Management. In the case of CmActLicense, CodeMeter Runtime Service determines the required properties for the binding to the computer and hides the information related to the activation securely on the target computer. On terminal servers and in virtual environments, CodeMeter Runtime Service ensures that licenses used simultaneously on different workstations are counted separately (for each session and each machine). When running on a license server in a LAN or WAN, it also makes licenses for CodeMeter Runtime Services on network clients available.ĬodeMeter Runtime Service monitors the applications which are started and automatically assigns licenses to them in the event that any application crashes or the assignment of the license was forgotten by the developer. It is also in charge of managing available and used licenses and tracking their use. It runs in the background, usually as a service or daemon, and manages connected CmDongles, activated CmActLicenses, and the connection to the license server in LAN, WAN and cloud. The main component of CodeMeter Runtime is the CodeMeter Runtime Service. Individual software protection traning from Wibu-Systems: security, reliability, flexibility. Training in software licensing and software protection. Secure Password Management for the Siemens TIA Portal. Integrating CodeMeter License Central in an SAP back office solution. SAP Entitlement Management and Wibu-Systems CodeMeter. Software License Entitlement Management.
0 kommentar(er)
