Skip to main content
  • EN

Security

Permissions, roles, and administration. Security in data processing.

  • 150 Posts
  • 449 Replies
150 Posts
sameer
Contributor
sameerContributor
asked in Security
CVE-2021-33037 - Which version of Tomcat comes pre-packaged with the latest build 21627 ?

Hello Our security scan has detected a vulnerability against the version of Apache Tomcat installed.The Web server installed on the remote host is prior to 9.0.48. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_9.0.48_security-9 advisory. Tomcat Release-Notes: 9.0.44FME Server Build: FME Server 2021.1.1 / Build 21619 - win64 ThanksSameer

390
sameer
Contributor
J
junwenwang
asked in Security
How to remediate CVE-2022-21724 in FME Server and FME Desktop?

A serious security alert (CVE-2022-21724) was announced for the PostgreSQL JDBC driver on February 2, 2022. We need to upgrade PostgresSQL JDBC driver to 42.2.25 and above to remediate it.  We have identified total 4 PostgresSQL JDBC drivers in FME Server and FME Desktop:[FME Server Root]\\Utilities\\tomcat\\lib\\postgresql-42.2.24.jar[FME Server Root]\\Utilities\\jdbc\\postgresql-42.2.24.jar[FME Server Root]\\Server\\fme\\plugins\\postgresql-42.2.16.jar[FME Desktop Root]\\FME\\plugins\\postgresql-42.2.16.jar Is there any patch available to remediate this vulnerability in those products? Or can we just replace those drivers with the required version?

590
J
rebeccagiannuzz
Contributor
rebeccagiannuzzContributor
asked in Security
I am running an FME 2019.2 workbench using task scheduler but it's not working. The error is below. Issue is not the user since the same user is running other tasks. Only occurs with FME workbenches.

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {228826AF-02E1-4226-A9E0-99A855E455A6} and APPID {2FD08A73-D1F1-43EB-B888-24C2496F95FD} to the user <user> SID (S-1-5-21-73586283-1409082233-725345543-564895) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

650
rahulsharma
Safer
kjetilpettersso
Contributor
kjetilpetterssoContributor
asked in Security
FME Server and Spring4Shell vulnerability

Is FME Server affected by the recent vulnerability discovered in Spring Core? https://www.contrastsecurity.com/security-influencers/new-spring4shell-vulnerability-confirmed-what-it-is-and-how-to-be-prepared

250
kjetilpettersso
Contributor
jkr_wrk
Influencer
jkr_wrk
asked in Security
Create OAuth2 with responseCode in header

I have a working Postman script for an OAuth2 connection.When I look at the raw headers it shows that it sends the following headers:Content-Type: application/x-www-form-urlencodedAuthorization: Basic QjIzRkI3RUU5RTZDRZZZQTRCRDJGNjVEOUM5ZZZxNjE6QzAzM0ZDOTU0RjM5NDQ1Qjg2RjdCOUQ1QzlGQzQ2MDYwM0Q1QkUwNEIzMEE3ZZZDMzFCMTI5NzM5M0MxQUMwRQ==User-Agent: PostmanRuntime/7.29.0Accept: */*Cache-Control: no-cachePostman-Token: a8126467-b10d-4a59-b116-f8a6d1160aa8Host: projectlocation.relaticsonline.comAccept-Encoding: gzip, deflate, brConnection: keep-aliveContent-Length: 182Cookie: SESSION_START_COOKIENAME_29C5C999-84D0-4D23-A8F0-F888A8C64C78=trueBut if I add a new Webservice with the OAuth2 template in FME it looks like it is sending:https://projectlocation.relaticsonline.com/oauth2/token redirect_uri=https://localhost/client_id=12345567890client_secret=ASDFJKLgrant_type=authorisation_codecode=[responseCode] Accept=application/jsonContent-Language=en-USContent-Type=application/x-www-form-urlencodedI

120
jkr_wrk
Influencer
S
sseth2011
asked in Security
How to call a FME workspace (as webhook) without passing security token in header?

We have a use case where we need to implement a webhook using FME. This will be called by a partner application.This webhook has a predefined URI (in partner application side) like:https://fmeserver/repo/worskapce1.fmw?attr=?attr2=?Names of parameters cannot be changed and partner application is not willing to update the webhook to pass security token in the header. We are planning to do security by only whitelisting the ip addresses of the partner application. In this case, how we do call the FME workspace? Everytime I try to call my workspace, it returns an following error"401-Unauthorized. The request has not been applied because it lacks valid authentication credentials for the Target resource" Is there no way to call FME workspaces without passing tokens in the header of the call?Is there a way to change the name of the token attribute in the header to something else? I can repurpose attr2 for this and provide a static token to the application.

1270
hkingsbury
Celebrity
bbo
Contributor
bboContributor
asked in Security
How to secure web connections in FME Desktop

Currently we are usen FME Desktop 2020.1. In the webconnection we have made connections to our ESRI platform (Arcgis Enterprise). SO when using a workbench data can be extracted from our arcgis enterprise portal. Is it possible to secure the data stored in a web connection in FME Desktop. We would like to prevent anyone who has gained acces to one of our account to also use the web connections to reach the account data stored in the web connection.

80
redgeographics
Celebrity
jvdkleijn_ehv
Contributor
jvdkleijn_ehvContributor
asked in Security
Necessity log4j version 1.xxxxxx

Hello all, Our IT department has the policy to remove all the vulnarible Log4j related files from the systems which came from a server scan.  We have a FME server 2020.1 with engine 2020.2.5The scan gives the following files: C:\\Program Files\\FMEServer\\Server\\fme\\plugins\\activemq-all-5.6.0.jarC:\\Program Files\\FMEServer\\Server\\fme\\plugins\\log4j-1.2.16.jarC:\\Program Files\\FMEServer\\Server\\FMEEngineUpgrade\\plugins\\activemq-all-5.6.0.jarC:\\Program Files\\FMEServer\\Server\\FMEEngineUpgrade\\plugins\\log4j-1.2.16.jarC:\\Program Files\\FMEServer\\Server\\lib\\log4j-1.2.14.jarC:\\Program Files\\FMEServer\\Utilities\\tomcat\\webapps\\fmeapiv4.warC:\\Program Files\\FMEServer\\Utilities\\tomcat\\webapps\\fmeapiv4\\WEB-INF\\lib\\logback-classic-1.2.3.jarC:\\Program Files\\FMEServer\\Utilities\\tomcat\\webapps\\fmerest.war","WEB-INF/lib/log4j-1.2.14.jarC:\\Program Files\\FMEServer\\Utilities\\tomcat\\webapps\\fmerest\\WEB-INF\\lib\\log4j-1.2.14.jar What would be the e

370
jvdkleijn_ehv
Contributor
jvdkleijn_ehv
Contributor
jvdkleijn_ehvContributor
asked in Security
java version, Adobe Reader/Writer, Adobe flash

Hi,We have installed a FME Server 2020.1.1.1 with a 2020.2.5.1 engine.Our security department has te following questions : •            Are there plans to upgrade the Java version to the newest version? •            Is the installation of Adobe Reader/Writer a part of the global installation?•            Is the installation of Adobe Flash a part of the global installation? Hopefully somebodey can answer the questions. with kind regards, John van der KleijnFunctional manager GISMunicipality Eindhoven

160
daraghatsafe
D
dgfip-fr
asked in Security
Remote command execution and directory traversal vulnerabilities

Hi, I found remote command execution and directory traversal vulnerabilities on FME Server 2020.2.3.How can I send you the exploit ? Do you have a mail dedicated to security alerts ?Regards

60
M
hkingsbury
Celebrity
hkingsburyCelebrity
asked in Security
CVE-2021-44228 - Log4j vulnerability

Hey all, seems a new vulnerability is currently being exploited across the wider network. From what @Todd Davis​ and myself have determined, it seems it will effect FME Server. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228https://arstechnica.com/information-technology/2021/12/minecraft-and-other-apps-face-serious-threat-from-new-code-execution-bug/ Further investigation seems to show that FME Server 2021.1 and on wards contain 2.13. Versions post 2.10 can include the following parameter to mitigate the exploit:‐Dlog4j2.formatMsgNoLookups=True https://www.zdnet.com/article/security-warning-new-zero-day-in-the-log4j-java-library-is-already-being-exploited/

1430
hkingsbury
Celebrity
Y
ymotake
asked in Security
We are using FME Server 2021.0.0.1. In order to be safe against Security Vulnerability Reported Against log4j, do we need to update our current version to 2021.2 ? or should we stay on our current version and wait for the 2022 version?

We are using FME Server 2021.0.0.1. In order to be safe against Security Vulnerability Reported Against log4j, do we need to update our current version to 2021.2 ? or should we stay on our current version and wait for the 2022 version?

230
andreaatsafe
Safer
john.beck
Contributor
john.beckContributor
asked in Security
OneDrive connection security in Server App

I would like to know if I could compromise my microsoft account (hacker accessing my One Drive files and microsoft account) by putting my connection credentials for OneDrive in a script on the FME Cloud that is then accessed via a Server App.

340
J
jbradfor
Contributor
jbradforContributor
asked in Security
GCP Service Account - Web Connection

We have created a GCP Service Account. Although we got the File based Cred/Python ingestion to work, we are not happy with that approach as far as security risks. Is there a way to establish a Web Connection to GCP BigQuery using a Service Account (FME 2019.2)? 

210
chrisatsafe
Contributor
oliver.morris
Contributor
oliver.morrisContributor
asked in Security
License server calling closed ports

We have an issue where the license server (flex) is going through loads of ports which are closed before finding an open one, as a result everytime we try to run FME it hangs for about 30s waiting for the license ping back, is there anything we can do to try to consistently use an open port? We dont seem to have issues with other licenses that are hosted on that server.

100
oliver.morris
Contributor
francis
Contributor
francisContributor
asked in Security
Security issue with database connections/web connections

You can set security on database/web connections but the admin user has the permission to view, use and execute by default. Assume that a user knows the name of a secure database connection on the server and use that same name in his workbench as a private parameter with different parameters but with the same as the secure connection on the server. When the user upload his workbench to the server, he will not be able to execute the workbench on the server because he doesn't have the permission to use the database connection on the server. But he asks to schedule his workbench and the admin user configures the schedule for this workbench. From that moment the workbench is able to use the database connection on the server because the admin user has the permission to use the secure database connection.A solution could be that the schedule is configured by another user than admin. Is there any other way to handle this security issue?We are running FME Server 2020.1.3 and our engines ar

160
david_r
Celebrity
M
misazab95
asked in Security
How can i upload license file via API?

I´m executin this command to upload the FME license: curl -X POST "https://localhost:443/licensing/license?filetype=fmelic" -H "Authorization: fmetoken token=****" -H "Content-type: application/octet-stream" -H "Accept: application/json" --data "@fme_license.fmelic" But i got this error:<!doctype html><html lang="en"><head><title>HTTP Status 404 – Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 – Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Message</b> The requested resource [/licensing/license] is not available</p><p><b>Description&

130
H
B
bgogulapati
asked in Security
I would like to know what TLS version is supported for FME 2020 desktop.

I would like to know what TLS version is supported for FME 2020 desktop.

1520
rahulsharma
Safer
adamdunlap
adamdunlap
asked in Security
I have a copy of FME Server for Linux. After looking at the documentation, can I integrate Windows Active Directory/LDAP from a Windows Domain Controller? I didn't see any RHEL 7 'linux' based configurations in the guide...

I have a copy of FME Server for Linux. After looking at the documentation, can I integrate Windows Active Directory/LDAP from a Windows Domain Controller? I didn't see any RHEL 7 'linux' based configurations in the guide...

130
H
mattwilkie
Supporter
mattwilkieSupporter
asked in Security
SSL error on FME Server but Desktop is fine.

We get the error "Can't connect to HTTPS URL because the SSL module is not available." when running a workspace on FME Server but the same workspace run from FME Desktop is okay. FME Desktop 2020.2.1.0 (20201130 - Build 20806 - WIN64)FME Server 2020.2 Build 20787 - win64 ```2021-1-26 19:19:35 | ArcGIS Feature Service Reader: Requesting metadata for Feature Service at 'http://mapservices.gov.yk.ca/arcgis/rest/services/GeoYukon/GY_Biophysical/MapServer'2021-1-26 19:19:48 | ArcGIS Feature Service Reader: Could not connect to server. Check that you are connected to the internet and that no firewall is blocking outbound connections. The error was 'HTTPSConnectionPool(host='mapservices.gov.yk.ca', port=443): Max retries exceeded with url: /arcgis/rest/services/GeoYukon/GY_Biophysical/MapServer?f=json (Caused by SSLError("Can't connect to HTTPS URL because the SSL module is not available."))' ```Digging around on Stack Overflow and similar s

2470
mattwilkie
Supporter
nissedahlsten
Contributor
nissedahlstenContributor
asked in Security
Borrow license from license server to offline client (top-secret computer not allowed to be online)?

I have a customer that 4-5 times a year need to run an fme workspace on an offline computer. This computer can not be connected to any network at all.They have floating licenses and now would like to borrow a license without connecting to client to the license server.Is this possible?

190
david_r
Celebrity
clowncutie
Contributor
clowncutieContributor
asked in Security
Help / Error Setting up Email to Server

Hi, I followed this guide: Sending email, Part 1: Setting up a topic and an email subscriber (safe.com) And we know our port is 25. I followed the guides and troubleshooting, turned the Allow Less Secure apps ON in gmail as well. But still I get stuck on the Creating the email subscription step, the validate gets this error:SSL error occurred. Ensure connection security and port are correct. Unrecognized SSL message, plaintext connection? I am on company server via VPN so I cannot access the services.msc or make changes to the firewall. Any idea if I entered something wrong? 

1310
clowncutie
Contributor
langdonms
Contributor
langdonmsContributor
asked in Security
Security of FME Server results download link

Hello, I'm curious if there are any potential security issues with a data download application via the result download link. How long do these download links last? Can they be scraped by bad actors? It seems even with an authenticated application the results URL is still publicly accessible in this format: https://[servername]/fmedatadownload/results/FME_[A-Z0-9staticstring]_[0-9string(datestamp perhaps?)]_[0-9]*4.zipIs this already an encoded token? Thanks!

890
J
M
melvin
asked in Security
Unable to access FME floating license

We cannot access an FME Desktop floating license from a remote computer. The remote computer locates the license server and requests a license, but the license server returns the error message, "FME floating license system failure: no SERVER lines in license file(-13)". Accessing FME Desktop on the license server itself is successful, however, and the license file appears to be correct (safe.lic in the C:\\FlexServer folder). Unfortunately, the FlexNET documentation does not provide a solution or troubleshooting options to the error message.

1270
M
lobsterboy
lobsterboy
asked in Security
Directory and File Pathnames Reader - - warning - No files found in folder '____' using glob pattern '**/*' with glob filter 'ANY'. No features will be read

I am using the Directory and File Pathnames reader and I receive the warning. No files found in folder '____' using glob pattern '**/*' with glob filter 'ANY'. No features will be read.However, there are clearly folders in this location   To ensure it wasn't security issues, I tested the Adobe Geospatial PDF reader to read a PDF within the folder and it can read the contents perfectly. Does anyone have any idea why I can't read any directories or pathnames?  

800
daraghatsafe

Badge Winners

Show all badges

Community Stats

31,501
Posts
119,413
Replies
39,117
Members

Latest FME

Terms & ConditionsCookie settings
A product of
Safe Software respectfully acknowledges that we live, learn and work on the traditional and unceded territories of the Kwantlen, Katzie, and Semiahmoo First Nations.