Re: Remote code execution exploit found in Log4j

This is correct.

The bug is indeed in Log4j, NOT the web server. Both just happen to be from Apache. As such it affects Websphere if you're using this log module but not straight up Apache web servers, they don't run Java.

It may affect Domino servers (noted was some help functions) but only if certain modules are installed/enabled. HCL is the definitive source on that of course.

As noted though it's possible your Apache server feeds its logs to a server using Log4j and that would then be vulnerable.

I think part of the confusion here is the word Apache. Apache in this case refers NOT to the Apache Web Server (a VERY commonly used server on IBM i) but instead to the Apache software foundation. So it's rather easy to incorrectly assume that the Apache web server is vulnerable here when that is not the case.

- DrF

On 12/13/2021 9:17 AM, Kevin Bucknum wrote:

By Apache instances you mean the Apache web server? This isn't a bug in the Apache web server. It's a bug in a java logging library that is commonly used. If your web server fronts a java application, then it may possibly be affected. If you have Apache serving static pages or CGI via RPGLE or some other non java language, then you should be ok. One thing to watch for. We feed all of our logs to a common log server that was affected.

On Mon, 2021-12-13 at 13:48 +0000, Greg Wilburn wrote:
So how do we know whether our system is affected by this?
Does this apply to all Apache instances?

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx<mailto:midrange-l-bounces@xxxxxxxxxxxxxxxxxx>> On Behalf Of Rob Berendt
Sent: Monday, December 13, 2021 7:27 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx<mailto:midrange-l@xxxxxxxxxxxxxxxxxx>>
Subject: RE: Remote code execution exploit found in Log4j - CVE-2021-44228

Anyone see any issues with following the recommendation by Jesse Gorzinski at
https://twitter.com/IBMJesseG/status/1470236777579532292

<snip>
ADDENVVAR ENVVAR(JAVA_TOOL_OPTIONS) VALUE('-Dlog4j2.formatMsgNoLookups=true') REPLACE(*YES) LEVEL(*SYS)
Might be a good idea until the impact assessment is complete
</snip>

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 7310 Innovation Blvd, Suite 104
Ft. Wayne, IN 46818
Ship to: 7310 Innovation Blvd, Dock 9C
Ft. Wayne, IN 46818
http://www.dekko.com

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx<mailto:midrange-l-bounces@xxxxxxxxxxxxxxxxxx>> On Behalf Of Rob Berendt
Sent: Monday, December 13, 2021 6:02 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx<mailto:midrange-l@xxxxxxxxxxxxxxxxxx>>
Subject: RE: Remote code execution exploit found in Log4j - CVE-2021-44228

Midnight hour update about WAS on IBM i
https://www.ibm.com/support/pages/node/6525706

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 7310 Innovation Blvd, Suite 104
Ft. Wayne, IN 46818
Ship to: 7310 Innovation Blvd, Dock 9C
Ft. Wayne, IN 46818
http://www.dekko.com

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx<mailto:midrange-l-bounces@xxxxxxxxxxxxxxxxxx>> On Behalf Of Charles Wilt
Sent: Friday, December 10, 2021 2:19 PM
To: Java Programming on and around the iSeries / AS400 <java400-l@xxxxxxxxxxxxxxxxxx<mailto:java400-l@xxxxxxxxxxxxxxxxxx>>; Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx<mailto:midrange-l@xxxxxxxxxxxxxxxxxx>>
Subject: Remote code execution exploit found in Log4j - CVE-2021-44228

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.

(cross posted to Java400 and Midrnage-L)

Anybody seen any information about the Java apps used by the OS?

Charles

https://www.lunasec.io/docs/blog/log4j-zero-day/
*Updated @ December 10th, 10am PST*

A few hours ago, a 0-day exploit in the popular Java logging library log4j2 was
discovered that results in Remote Code Execution (RCE) by logging a certain
string.

Given how ubiquitous this library is, the impact of the exploit (full
server control), and how easy it is to exploit, the impact of this
vulnerability is quite severe. We're calling it "Log4Shell" for short
(CVE-2021-44228 just isn't as memorable).

The 0-day was tweeted
<https://twitter.com/P0rZ9/status/1468949890571337731> along
with a POC posted on GitHub
<https://github.com/tangxiaofeng7/apache-log4j-poc>. Since this
vulnerability is still very new, there isn't a CVE to track it yet. This
has been published as CVE-2021-44228
<https://www.randori.com/blog/cve-2021-44228/> now.
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx<mailto:MIDRANGE-L@xxxxxxxxxxxxxxxxxx>
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx<mailto:MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx>
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx<mailto:support@xxxxxxxxxxxxxxxxxxxx> for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link: https://amazon.midrange.com
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx<mailto:MIDRANGE-L@xxxxxxxxxxxxxxxxxx>
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx<mailto:MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx>
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx<mailto:support@xxxxxxxxxxxxxxxxxxxx> for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link: https://amazon.midrange.com
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx<mailto:MIDRANGE-L@xxxxxxxxxxxxxxxxxx>
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx<mailto:MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx>
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx<mailto:support@xxxxxxxxxxxxxxxxxxxx> for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link: https://amazon.midrange.com

[https://www.medtronsoftware.com/img/MedtronMinilogo.bmp]
Kevin Bucknum

Senior Programmer Analyst

MEDDATA / MEDTRON

120 Innwood Drive
Covington LA 70433
Local: 985-893-2550<tel:985-893-2550>
Toll Free: 877-893-2550<tel:877-893-2550>
https://www.medtronsoftware.com

CONFIDENTIALITY NOTICE

This document and any accompanying this email transmission contain confidential information, belonging to the sender that is legally privileged. This information is intended only for the use of the individual or entity named above. The authorized recipient of this information is prohibited from disclosing this information to any other party and is required to destroy the information after its stated need has been fulfilled. If you are not the intended recipient, or the employee of agent responsible to deliver it to the intended recipient, you are hereby notified that any disclosure, copying, distribution or action taken in reliance on the contents of these documents is STRICTLY PROHIBITED. If you have received this email in error, please notify the sender immediately to arrange for return or destruction of these documents.

Re: Remote code execution exploit found in Log4j - CVE-2021-44228