IDL & ENVI License Server Security Patch
THIS INFORMATION ONLY PERTAINS TO SOFTWARE VERSIONS IDL 8.5, ENVI 5.3 AND PRIOR
Overview
Harris Geospatial Solutions announces a security patch for the license server for IDL & ENVI software products that addresses the following Common Vulnerabilities and Exposures (CVE-2015-8277) and US CERT Vulnerability Note (VU#485744):
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8277
http://www.kb.cert.org/vuls/id/485744
Harris recommends that all customers using a license server for IDL & ENVI products update their license manager software installations as delineated in the 'Installing This Patch' section below.
The license management of the IDL & ENVI software products is built with a third party software component called Flexera FlexNet Publisher. Recently a buffer overflow security vulnerability was identified in Flexera's FlexNet Publisher technology. To address this vulnerability Harris has acquired the latest FlexNet Publisher (v11.13.1.3) then built new lmgrd and vendor daemon components that are included with this IDL & ENVI software patch.
NOTE: This security vulnerability only applies to computers running a license manager server involving scenarios where a license manager server is utilized. As a best practice Harris does not recommend exposing access to the IDL & ENVI license manager externally or anonymously on the public internet. If the affected license server components are only exposed on a trusted network the CVSS severity of this vulnerability is significantly reduced.
Issues Addressed
This patch for the IDL & ENVI software addresses the following issues:
- ENVI-70768: Security vulnerability in FlexNet 11.12.1.2 included with IDL & ENVI software
Affected Versions
The Flexera FlexNet Publisher software component that is impacted by the buffer overflow security vulnerability is utilized in the following versions of the IDL & ENVI software:
- IDL 8.5.1 and all older versions
- ENVI 5.3 SP1 and all older versions
- Exelis Products FlexLM License Server 8.5.1 and all older versions
Please note that future planned versions starting with IDL 9.0 and ENVI 6.0 scheduled for release in 2016 will include the patched lmgrd and vendor daemon components in order to address this security vulnerability in an out-of-the-box fashion.
Determine Installed Versions
To determine which versions of the IDL & ENVI software are installed on a computer system please refer to the instructions in the following help article:
Installing This Patch
NOTE: Only computers running a license manager server need to be updated with this patch.
There are two scenarios where this license server security patch should be installed:
(1) IDL & ENVI product software installations
(2) Standalone installations of the Exelis Products FlexLM License Server
To install this license management security patch in these two scenarios:
(1) For the IDL & ENVI software packages please visit the Downloads section of our website (link below), login using your Harris Geospatial Solutions (Exelis VIS) account credentials, download the appropriate"IDL & ENVI License Server Security Patch" for your operating system and follow the associated installation instructions:
(2) A new version of the standalone "Exelis Products FlexLM License Server" will soon be available for download the Downloads section of our website:
This is required if you install and run the license server separate from the IDL & ENVI software installations. This typically occurs in situations where you run a floating license server on a computer that does not actually have the IDL & ENVI software installed.
Getting Help
If you need assistance updating your IDL or ENVI software installations with this security patch please visit our dedicated Request Technical Support webpage:
https://www.harrisgeospatial.com/MyAccount/SupportRequests.aspx
Or send our Technical Support an e-mail directly:
For reference the Supported Software Versions are delineated in the Software Maintenance and Technical Support Policy.
ao 3/16/2016; kk 3/16/2016