Genus Media Upshot products and Log4j security vulnerability

On December 9th, 2021, a critical security vulnerability was found in the Log4j logging utility. Log4j is a widely used open-source utility used to generate log messages from Java applications.  The vulnerability CVE-2021-44228 , also known as Log4Shell or LogJam, permits a Remote Code Execution (RCE) allowing attackers to execute arbitrary code loaded from an attacker-controlled LDAP server when message lookup substitution is enabled in Log4j.  

The Log4j utility is used in some of the applications written by Genus as well as many of the products Genus specializes in.  Almost all versions of Log4j Version 2 are susceptible: 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0.  Log4j Version 1.x is not vulnerable to this exploit but does have exposure to other lower-priority vulnerabilities.

Log4j version 2.15.0 was initially released that turned message lookup substitution off by default.  Log4j version 2.16.0 was subsequently released to address a lower-priority vulnerability, CVE-2021-45046.  2.16.0 disabled message lookup substitution entirely, disables access to JNDI by default, limits the protocols by default to only java, ldap, and ldaps and limits the ldap protocols to only accessing Java primitive objects. Hosts other than localhost need to be explicitly allowed. 2.17.1 further limits exploitability by limiting JNDI data source names, CVE-2021-44832

A quick way to assess if you are impacted by this CVE is to search the file systems of your servers for “log4j-core-2.*.jar”.

If you’re impacted by this CVE, remediation options include:

1. Upgrade to a patched version of the software that includes Log4j 2.17.1 or higher

1. If the application is using Log4j 2.10 or higher, add the JVM argument

             -Dlog4j.formatMsgNoLookups=true

         To disable Log4j message lookup substitution.

1. Replace the log4j-core-2.x.jar with the new logj4-core-2.17.1.jar (or higher when available). You may need to update references to this .jar in manifest.mf and other files.

1. Remove the JndiLookup class from the jar file manually:

               zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class

Below is a list of components used by Media Upshot, their vulnerability status, suggested remediation, and links to find more information.