- - Community Resources
Ideas
Product Updates
Events
Blog

Home
Forums
FME Flow
Security

Security

Permissions, roles, and administration. Security in data processing.

135 Posts
399 Replies

When you subscribe we will email you when there is a new topic in this category

135 Posts

Recently active

Most replies Most views Newest first

dominikw

asked in Security

Is FME Server affected by CVE-2022-42889 (Apache Commons Text versions 1.5 through 1.9)

Hello,Is there any info if FME server is affected by new vulnerability CVE-2022-42889 (Apache Commons Text versions 1.5 through 1.9)?

When creating a connect to AD, what is the synchronnization period?

2 years ago

agelfert

asked in Security

How many ports does FMEProcessMonitorEngines use at any given time?

I've been digging into issues with an Engine running on a separate host in a distributed setup. Service looks to be running but is no longer chatting with Core and is not longer showing up under Engines in the web UI. After ruling out some of the obvious causes on this troubleshooting page. I've started logging running processes and ports being used on that Host to understand at what point the service goes silent or inactive. That's when I noticed what seems like large number of TCP connections FMEProcessMonitorEngines uses with multiple ports open. The Architecture Diagram and Documentation are really helpful. So I recognize the 7070 for FMEEngines services and the 7082 for Database Server but then there are a bunch of ports that I assume are what FME dynamically picks. If I only have one job executing on that engine at a given time, how many of those ports/connections will be in play? Is having 3-5 or so that I don't recognize an indication that something may not be

Latest Security Advisory, XSS, and CVE assignments. Can someone make sense of this please.

https://community.safe.com/s/article/FME-Server-Stored-Cross-Site-Scripting-XSS-Vulnerabilities In this latest advisory it's mentioned that there are two specific XSS issues, and two different CVE assignments. That's all well and good, even if there is a ton of lacking pertinent information. The problem I'm having is that this CVE (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38339) was assigned to this specific advisory but there's zero mention of it. Does anyone know specifically why 2022-38339 was assigned?

Quick question about the Windows account that FME Server uses. If I write an FME script that reads from, say, a CSV file and writes to an Oracle table, the Oracle account that gets used is specified in the connection parameters. But what Windows ac

2 years ago

ridleyjContributor

asked in Security

How to stop high CPU usage overheads with windows security scanning each FME desktop temporary file write

Using FME(R) 2021.2.5.0 (20220331 - Build 21816 - WIN64) desktop on windows PRO build 2009.1766 65g RAM, 6 cores, experiences massive CPU drain when running a LIDAR density analysis out to raster via the custom transformer as in article - Calculating Point Cloud Density (safe.com)The two step tiler seems to trigger a Windows security scan when using the FME_TEMP directory as FME writes the (many) temporary cache ffs files down to disk when demanding a 1m high res raster result. The security kicks in and the CPU starts skipping up to 80%+ which drags the performance way down on large LIDAR file sets. Setting the raster res lower (10m) doesn't seem to trigger the same issue The FME_TEMP directory cannot be included in the security white list (corporate policy settings only - as each workstation /individual may have a different FME_TEMP location), and therefore although FME and the install directories are white-listed per FME Community (safe.com), the FME_TEMP directory is subject to

Hello, there is a security issue with the FME Server Job Submitter and/or the Password-type user parameter. If the job submitter returns an error, the password is decrypted and shown in the log. This should not happen. [FME 2018.1]

I have created an encoded password user parameter and used it with the job submitter, but if the job submitter returns an error, the password is decrypted and shown in the log, as seen in the screenshots below.

2 years ago

bharath

asked in Security

how to secure FME Workbench?

Hi,I have a FME workbench, so i have to use it within my organization and i want to restrict it to outsiders based on domain name or in any possible way. how can i do this ?

281

2 years ago

mkastelijnsContributor

asked in Security

Does the FME platform use the DCOM-protocol in any way?

Dear community,Upcoming June the 14th Microsoft DCOM will get ‘hardened’ by a update. Therefore I would like to know if the DCOM-protocol is used in any way within FME and if anyone knows this update could affect FME server. If this is the case, it is necessary to test the new hardening. For more information on this update: (https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-windows-dcom-server-security-feature-bypass-cve-2021-26414-f1400b52-c141-43d2-941e-37ed901c769c) Used FME server versions: FME server 2018.1 & 2021.1

2 years ago

sameerContributor

asked in Security

CVE-2021-33037 - Which version of Tomcat comes pre-packaged with the latest build 21627 ?

Hello Our security scan has detected a vulnerability against the version of Apache Tomcat installed.The Web server installed on the remote host is prior to 9.0.48. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_9.0.48_security-9 advisory. Tomcat Release-Notes: 9.0.44FME Server Build: FME Server 2021.1.1 / Build 21619 - win64 ThanksSameer

How to remediate CVE-2022-21724 in FME Server and FME Desktop?

A serious security alert (CVE-2022-21724) was announced for the PostgreSQL JDBC driver on February 2, 2022. We need to upgrade PostgresSQL JDBC driver to 42.2.25 and above to remediate it. We have identified total 4 PostgresSQL JDBC drivers in FME Server and FME Desktop:[FME Server Root]\\Utilities\\tomcat\\lib\\postgresql-42.2.24.jar[FME Server Root]\\Utilities\\jdbc\\postgresql-42.2.24.jar[FME Server Root]\\Server\\fme\\plugins\\postgresql-42.2.16.jar[FME Desktop Root]\\FME\\plugins\\postgresql-42.2.16.jar Is there any patch available to remediate this vulnerability in those products? Or can we just replace those drivers with the required version?

344

2 years ago

rebeccagiannuzzContributor

asked in Security

I am running an FME 2019.2 workbench using task scheduler but it's not working. The error is below. Issue is not the user since the same user is running other tasks. Only occurs with FME workbenches.

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {228826AF-02E1-4226-A9E0-99A855E455A6} and APPID {2FD08A73-D1F1-43EB-B888-24C2496F95FD} to the user <user> SID (S-1-5-21-73586283-1409082233-725345543-564895) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

FME Server and Spring4Shell vulnerability

Is FME Server affected by the recent vulnerability discovered in Spring Core? https://www.contrastsecurity.com/security-influencers/new-spring4shell-vulnerability-confirmed-what-it-is-and-how-to-be-prepared

Create OAuth2 with responseCode in header

I have a working Postman script for an OAuth2 connection.When I look at the raw headers it shows that it sends the following headers:Content-Type: application/x-www-form-urlencodedAuthorization: Basic QjIzRkI3RUU5RTZDRZZZQTRCRDJGNjVEOUM5ZZZxNjE6QzAzM0ZDOTU0RjM5NDQ1Qjg2RjdCOUQ1QzlGQzQ2MDYwM0Q1QkUwNEIzMEE3ZZZDMzFCMTI5NzM5M0MxQUMwRQ==User-Agent: PostmanRuntime/7.29.0Accept: */*Cache-Control: no-cachePostman-Token: a8126467-b10d-4a59-b116-f8a6d1160aa8Host: projectlocation.relaticsonline.comAccept-Encoding: gzip, deflate, brConnection: keep-aliveContent-Length: 182Cookie: SESSION_START_COOKIENAME_29C5C999-84D0-4D23-A8F0-F888A8C64C78=trueBut if I add a new Webservice with the OAuth2 template in FME it looks like it is sending:https://projectlocation.relaticsonline.com/oauth2/token redirect_uri=https://localhost/client_id=12345567890client_secret=ASDFJKLgrant_type=authorisation_codecode=[responseCode] Accept=application/jsonContent-Language=en-USContent-Type=application/x-www-form-urlencodedI

How to call a FME workspace (as webhook) without passing security token in header?

We have a use case where we need to implement a webhook using FME. This will be called by a partner application.This webhook has a predefined URI (in partner application side) like:https://fmeserver/repo/worskapce1.fmw?attr=?attr2=?Names of parameters cannot be changed and partner application is not willing to update the webhook to pass security token in the header. We are planning to do security by only whitelisting the ip addresses of the partner application. In this case, how we do call the FME workspace? Everytime I try to call my workspace, it returns an following error"401-Unauthorized. The request has not been applied because it lacks valid authentication credentials for the Target resource" Is there no way to call FME workspaces without passing tokens in the header of the call?Is there a way to change the name of the token attribute in the header to something else? I can repurpose attr2 for this and provide a static token to the application.

853

2 years ago

bboContributor

asked in Security

How to secure web connections in FME Desktop

Currently we are usen FME Desktop 2020.1. In the webconnection we have made connections to our ESRI platform (Arcgis Enterprise). SO when using a workbench data can be extracted from our arcgis enterprise portal. Is it possible to secure the data stored in a web connection in FME Desktop. We would like to prevent anyone who has gained acces to one of our account to also use the web connections to reach the account data stored in the web connection.

2 years ago

jvdkleijn_ehv

asked in Security

Necessity log4j version 1.xxxxxx

java version, Adobe Reader/Writer, Adobe flash

Hi,We have installed a FME Server 2020.1.1.1 with a 2020.2.5.1 engine.Our security department has te following questions : • Are there plans to upgrade the Java version to the newest version? • Is the installation of Adobe Reader/Writer a part of the global installation?• Is the installation of Adobe Flash a part of the global installation? Hopefully somebodey can answer the questions. with kind regards, John van der KleijnFunctional manager GISMunicipality Eindhoven

Remote command execution and directory traversal vulnerabilities

Hi, I found remote command execution and directory traversal vulnerabilities on FME Server 2020.2.3.How can I send you the exploit ? Do you have a mail dedicated to security alerts ?Regards

2 years ago

hkingsburyCelebrity

asked in Security

CVE-2021-44228 - Log4j vulnerability

Hey all, seems a new vulnerability is currently being exploited across the wider network. From what @Todd Davis and myself have determined, it seems it will effect FME Server. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228https://arstechnica.com/information-technology/2021/12/minecraft-and-other-apps-face-serious-threat-from-new-code-execution-bug/ Further investigation seems to show that FME Server 2021.1 and on wards contain 2.13. Versions post 2.10 can include the following parameter to mitigate the exploit:‐Dlog4j2.formatMsgNoLookups=True https://www.zdnet.com/article/security-warning-new-zero-day-in-the-log4j-java-library-is-already-being-exploited/

We are using FME Server 2021.0.0.1. In order to be safe against Security Vulnerability Reported Against log4j, do we need to update our current version to 2021.2 ? or should we stay on our current version and wait for the 2022 version?

163

2 years ago

john.beckContributor

asked in Security

OneDrive connection security in Server App

I would like to know if I could compromise my microsoft account (hacker accessing my One Drive files and microsoft account) by putting my connection credentials for OneDrive in a script on the FME Cloud that is then accessed via a Server App.

234

3 years ago

jbradforContributor

asked in Security

GCP Service Account - Web Connection

We have created a GCP Service Account. Although we got the File based Cred/Python ingestion to work, we are not happy with that approach as far as security risks. Is there a way to establish a Web Connection to GCP BigQuery using a Service Account (FME 2019.2)?

191

3 years ago

oliver.morrisContributor

asked in Security

License server calling closed ports

We have an issue where the license server (flex) is going through loads of ports which are closed before finding an open one, as a result everytime we try to run FME it hangs for about 30s waiting for the license ping back, is there anything we can do to try to consistently use an open port? We dont seem to have issues with other licenses that are hosted on that server.

3 years ago

francisContributor

asked in Security

Security issue with database connections/web connections

You can set security on database/web connections but the admin user has the permission to view, use and execute by default. Assume that a user knows the name of a secure database connection on the server and use that same name in his workbench as a private parameter with different parameters but with the same as the secure connection on the server. When the user upload his workbench to the server, he will not be able to execute the workbench on the server because he doesn't have the permission to use the database connection on the server. But he asks to schedule his workbench and the admin user configures the schedule for this workbench. From that moment the workbench is able to use the database connection on the server because the admin user has the permission to use the secure database connection.A solution could be that the schedule is configured by another user than admin. Is there any other way to handle this security issue?We are running FME Server 2020.1.3 and our engines ar

141

3 years ago

Page 4 / 6

Badge winners

changeofmotionhas earned the badge Teacher (Grey)
User15923979821343989192has earned the badge Welcome Back
ahmadrezakarimhas earned the badge Teacher (Grey)
oliverquirkehas earned the badge Welcome Back
johnthas earned the badge Student (Bronze)

Show all badges

30,143: Posts

Terms & Conditions Cookie settings

Sign up

Already have an account? Login

An FME Account is required to contribute

Login to the community

An FME Account is required to contribute

Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.

Enter your e-mail address

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.

A product of

Company Products Giving Back Careers Contact Privacy Feedback

Safe Software respectfully acknowledges that we live, learn and work on the traditional and unceded territories of the Kwantlen, Katzie, and Semiahmoo First Nations.