[R2] Citrix License Server / Flexera FlexNet Publisher lmadmin.exe 2F Packet Handling Remote DoS

While working on detection plugins for the Nessus vulnerability scanner, we identified a new issue in Citrix License Server and Flexera Flex License Manager (now FlexNet Publisher). This is potentially due to a partial or incomplete fix for the vulnerability in specified by CVE-2015-8277, or it may be a similar issue in a different binary.

It appears that the Citrix license server runs lmadmin.exe rather than lmgrd.exe, which is probably an important detail considering we could not crash or cause remote code execution using the method outlined in the original research with an older (unpatched) version of the license manager, and they may not in fact be affected by it though we could not confirm this. Due to the convoluted nature of the relationship between Flexera License Manager, Flexera Publisher, and the various Citrix software (much of which shares the same version scheme), it isn't clear where the fault lies. If we had to guess, we'd say this is most likely a flaw in Citrix License Server building against the outdated Flexera version, or perhaps a flaw in Flexera via a different service/binary than previously disclosed. As such, we'll get both companies involved.

This issue was discovered while fuzzing the Citrix License Server and was found in the lmadmin.exe image, and appears to be related to the binary passing some invalid arguments to an STL Container. Based on a cursory examination, this is unlikely to be a vector for remote code execution, and just a silly magic packet remote DoS. #sadpanda This was tested against freshly installed Citrix License Servers (i.e. they were serving no licenses at the time) on Windows 2012 R2 systems.

When the lmadmin.exe service encounters a type 2F packet with a '01 19' op code, the service would immediately crash, requiring a restart by an administrator. Since the software uses a proprietary binary-based protocol without public documentation, it isn't clear if these are considered 'malformed' packets, or if they are legitimate packets and the service wasn't designed to expect them. Hex dump of packet sent:

00000000: 2F C4 3A 1C 00 25 01 19  00 00 00 00 00 00 00 00  /.:..%..........
00000010: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
00000020: 00 00 00 00 00                                    .....

Tenable has developed a Python 2.7 proof of concept script (citrix_is_flexible.py), that does not require any special packages. We are sharing it with the two vendors, but not you. Sorry =(