ArchestrA License Manager User’s Guide Chapter 1 Using the ArchestrA License Manager This guide describes the ArchestrA License Manager and how to use it to install, maintain, and delete licenses and license servers on local and remo te computers. The guide also describes how to use the ArchestrA License Manager with hardware keys. This video walks through an example of offline (no internet needed) activating a Wonderware license using the Schneider Electric License Manager. Untuk menjalankan ArchestrA license manager bisa dipilih dari Program Wonderware ArchestrA License Server ArchestrA License Manager. Untuk install file license, pilih File Install License File. Pastikan untuk memilih file ArchestrAServer.LIC untuk menginstall Server License. Setelah proses instalasi, kita harus melakukan konfigurasi. Wonderware SIDirect DAServer is a free application that acts as a communications protocol server. It can communicate with multiple client protocols at the same time. The program uses the S7 communication protocol and is capable of DDE, FastDDE, SuiteLink or OPC connections to Windows client programs.

VisualGSM Lite SMS Server allows personalized broadcast of text/flash SMS messages using GSM modems or compatible GSM mobile phones via serial data cable or infrared link. Features include the ability to send unicode/Chinese SMS messages, send log, import/export addressbook, auto-detect...

Full-featured,high-performance 123FlashChat can integrate user db in forums or portals & has the most customized skin! It allows you to organize chat-events, collaborative work sessions or online meetings stably. With this exe client, even those members who unfortunately don't have flash player...

Xerver Free Web Server is a tiny web server allowing you to run CGI scripts on your computer. Xerver includes features such as: Run scripts (Perl, PHP etc.), create aliases (virtual directories), allow/deny directory listing, create your own error pages ('404 Not Found'), allow/deny CGI-scripts,...
Platforms: DOS, Windows, *nix

Free OS License Modifier can assist you to update Windows registration information on one or multiple remote computers located in a local network. Using this tool you are able to collect registered owner and registered organization information from remote computers and change it, if required. All...
Platforms: Windows

1st SMTP Server - a free SMTP relay server- is a simplest, easy to use SMTP mail relay server. It is used for relaying your email messages to its destinations quickly and easily. Whenever you need to send large amounts of email from a mass mailing program like Advanced Emailer You can install...
Platforms: Windows

PointBase® Server provides a reliable and scalable database for e-commerce, application servers, web servers and other Internet-based applications. The server design includes a multi-threaded architecture to ensure transactional integrity and performance under high transactional loads, row-level...

Set up a VPN server in less than 1 minute. Free client software. iPig creates a secure 'tunnel' that protects your inbound and outbound communications (Email, Web, IM, VOIP, calls, FTP, etc.) at any Wi-Fi hotspot or wired network. iPig works with any kind of Internet connection (Wifi, WLAN, wired...
Platforms: Windows

SQL Server to SQL Server Compact Edition Database Copy: The purpose of this utility to to provide a mechanism to copy Microsoft SQL Server databases to a SQL Server Compact Edition database. I developed this tool because I was unable to find a management tool that allowed me to design SQL Server...
Platforms: Windows

USB Server for Linux. This new unique software product allows to share any USB device to use them over local network or Internet. To share USB device plugged into computer with Linux OS you just need to install USB Server product into your system. Your system must have kernel v2.6.15 and higher...
Platforms: *nix, Source

The Number One HTTP Server On The Internet. The Apache Project is a collaborative software development effort aimed at creating a robust, commercial-grade, featureful, and freely-available source code implementation of an HTTP (Web) server.
Platforms: Windows, *nix

Share your content, showcase your hobbies, and promote your ideas with Hotline's unique Server application. Using the small and powerful Hotline Server you can open your computer to anyone you choose, remain in a secure environment and control your community at all times.

MDaemon FREE mail server software is a 5-user license version of the award-winning MDaemon Email Server for Windows. MDaemon FREE is perfect for home and SOHO users wanting a reliable mail server that will grow with their business. MDaemon FREE is available in multiple languages and...
Platforms: Windows

EasyLicenser is a flexible, low-cost and powerful software license manager focused on ease-of-use for both the ISV and the end-user. EasyLicenser also includes eCommerce and Customer Relationship Management functionality. EasyLicenser allows ISVs to cut their costs and increase revenue by...
Platforms: Windows, *nix, Windows CE

Abyss Web Server X1 is a free web server available for Windows, MacOS X, Linux, and FreeBSD. Despite its small footprint, it supports secure SSL connections (HTTPS), download resuming, caching negotiation, logging, CGI/1.1 scripts, FastCGI, ISAPI extensions, Server Side Includes (SSI), ASP.NET...
Platforms: Mac

Free SMTP Server is a SMTP server program for Windows that lets you send email messages directly from your computer. It's very simple but very useful for laptop users traveling around the world and connecting their PCs to different Internet Service Providers in different countries. You can use it...
Platforms: Windows, Windows 7

PacketTrap TFTP Server is a FREE multi-threaded file transfer utility. It supports simultaneous transfers and offers option negotiation between client and server, including clock size, transfer size, and timeout. It may be used to move configurations between routers, switches, hubs, and...
Platforms: Windows

SolarWinds free TFTP Server is a multi-threaded TFTP server commonly used to upload and download executable images and configurations to routers and switches. The free TFTP Server runs on most Microsoft« operating system, including Windows« XP, Vista, 2000, and 2003. While there are other free...
Platforms: Windows

Reliable network and website monitoring using Paessler's proven and constantly refined IPCheck technology which has been used for network management by many companies from SOHOs to Fortune 500 worldwide since 1997. Sensor types include PING, PORT, HTTP, HTTPS, HTTP Advanced, HTTP Transaction,...
Platforms: Windows

The YellowTip Web Server was developed to make available a highly professional and easily installable package of Apache, PHP4, MySQL4, phpMyAdmin and Zend Optimizer for the Windows platform (Win98, WinMe, Win2K, WinXP). With a convenient all-in-one installer, all components are installed in a...
Platforms: Windows

Halo Dedicated Server INI File Builder has been brought back from the dead. This was one of our first products on our site and was removed when Halo 2 was released for PC. Of course it stayed on the site because customers still needed to download their purchased copies. It turns out that the move...
Platforms: Windows

1. EXECUTIVE SUMMARY

• ATTENTION: Exploitable remotely/Low skill level to exploit
• Vendor: AVEVA Software, LLC (AVEVA)
• Equipment: Wonderware License Server
• Vulnerability: Improper Restriction of Operations within the Bounds of a Memory Buffer

2. RISK EVALUATION

Successful exploitation of this vulnerability may result in remote code execution with administrative privileges.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following versions of Wonderware License Server use the vulnerable Flexara Imgrd (Versions 11.13.1.1 and prior):

• Wonderware License Server v4.0.13100 and prior.

Only users with the Counted Licenses feature with “ArchestrAServer.lic” in Wonderware License Server are affected.
Wonderware License Server is delivered by:

Install Archestra License Manager Salary

• Wonderware Information Server 4.0 SP1 and prior, and
• Historian Client 2014 R4 SP2 P02 and prior.

3.2 VULNERABILITY OVERVIEW

3.2.1 IMPROPER RESTRICTION OF OPERATIONS WITHIN THE BOUNDS OF A MEMORY BUFFER CWE-119

Buffer overflows in lmgrd and vendor daemon in Flexera FlexNet Publisher may allow remote attackers to execute arbitrary code via a crafted packet, resulting in remote code execution with administrator privileges.

CVE-2015-8277 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Chemical, Critical Manufacturing, Energy, Food and Agriculture, and Water and Wastewater
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: United Kingdom

3.4 RESEARCHER

An anonymous researcher reported this vulnerability to AVEVA, who then reported it to NCCIC.

4. MITIGATIONS

AVEVA recommends affected users install update “Hotfix Wonderware License Server VU-485744” or later, which can be downloaded from:

https://softwaresupportsp.schneider-electric.com/#/producthub/details?id=5076 (login required)

AVEVA has published Security Bulletin LFSEC00000129. It can be found at the following location:

NCCIC recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

Wonderware License Manager

• Minimize network exposure for all control system devices and/or systems, and ensure that they are not accessible from the Internet.
• Locate control system networks and remote devices behind firewalls, and isolate them from the business network.
• When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices.

NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
NCCIC also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS-CERT website in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents.

No known public exploits specifically target this vulnerability.

Contact Information

For any questions related to this report, please contact the CISA at:
Email: CISAservicedesk@cisa.dhs.gov
Toll Free: 1-888-282-0870

For industrial control systems cybersecurity information: https://us-cert.cisa.gov/ics
or incident reporting: https://us-cert.cisa.gov/report

CISA continuously strives to improve its products and services. You can help by choosing one of the links below to provide feedback about this product.

This product is provided subject to this Notification and this Privacy & Use policy.

Please share your thoughts.

We recently updated our anonymous product survey; we'd welcome your feedback.