A number of critical security vulnerability within Apache log4j has been discovered lately.

CVE-2021-44228:

Log4j2 <= 2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled.

CVE-2021-45046:

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a denial of service (DOS) attack. Log4j 2.15.0 makes a best-effort attempt to restrict JNDI LDAP lookups to localhost by default. Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

CVE-2021-45105:

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0 and 2.12.3.

Apache log4j is used by Elasticsearch in the vMDM server as well as by the local vMDM feature on the client ("Computer collection"). It is not used for the logging of the vMDM application itself.

vMDM server: medium risk

• The Elasticsearch port is not exposed to the Internet.
• It is not possible for an attacker to provide any input to vMDM (via API or file) which will provoke an Elasticsearch log output as described in the CVE.
• CVE-2021-45105 is not applicable to Elasticsearch.

vMDM client: medium risk

• The Elasticsearch port is exposed to the local machine. Installation of vMDM will not create an exception to the local firewall rules, which means the port is not exposed to the local network or even the Internet.
• It is not possible for an attacker to provide any input to the local vMDM client (via API or file) which will provoke an Elasticsearch log output as described in the CVE
• CVE-2021-45105 is not applicable to Elasticsearch.

If you use vMDM pro or fun as Software as a Service (SaaS) in the Vector Cloud, the below mentioned actions have already been executed by Vector. No further action related to the server are required by you. Please proceed to the next section "Recommended actions (vMDM client)"

If you use vMDM pro OnPremise the remote code execution risk by CVE-2021-44228 and CVE-2021-45046 in the context of Elasticsearch can be fully mitigated by applying a simple configuration change on the vMDM server or VM where Elasticsearch is installed. CVE-2021-45105 is not applicable at all in the context of Elasticsearch. The procedure depends on the operating system:

Updated: Windows (with vmc):

• start vmc and shutdown vMDM with <Y>
• Start a text editor with local administrator rights and open C:\Program Files\Common Files\Vector\vMDM\vmc\templates\jvm.options
• Add the following line at the end of the file: -Dlog4j2.formatMsgNoLookups=true
• Save the file
• Re-apply the modified configuration vmc with <R>
• Start vMDM in vmc with <S>

Windows (without vmc):

• Start a text editor with local administrator rights and open C:\Program Files\Elastic\elasticsearch-5.6.16\elasticsearch-5.6.16\config\jvm.options
• Add the following line at the end of the file: -Dlog4j2.formatMsgNoLookups=true
• Save the file
• Open the Windows task manager and select the tab "Services"
• Look for the "elasticsearch" service and restart it

Linux:

• Log into the Linux VM
• Enter "sudo nano /etc/elasticsearch/jvm.options"
• Add the following line at the end of the file: -Dlog4j2.formatMsgNoLookups=true
• Exit and save with Ctrl+X, Y, Enter
• Stop the elasticsearch service with "sudo service elasticsearch stop"
• Restart the elasticsearch service with "sudo service elasticsearch start"

Update your vMDM client to vMDM 3.3 HF2 or later: vMDM Client Download

Vector also provides service packs and hotfixes for CANape, vSignalyzer and vMeasure which include an updated vMDM client. Please check www.vector.com for a Service Pack download