CVE-2021-44228 - log4j Vulnerability in CA Service Desk Manager

Products

CA Service Desk Manager CA Service Management - Service Desk Manager

Issue/Introduction

CVE-2021-44228

Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled

CVE-2021-45046

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a denial of service (DOS) attack. Log4j 2.15.0 restricts JNDI LDAP lookups to localhost by default. Note that previous mitigations involving configuration such as to set the system property `log4j2.noFormatMsgLookup` to `true` do NOT mitigate this specific vulnerability. Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default. This issue can be mitigated in prior releases (<2.16.0) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class).

Environment

Service Desk Manager 17.2 and 17.3

This KB article is only applicable for :

CA Service Management 17.2 GA to 17.2 RU17 versions
CA Service Management 17.3 GA to 17.3 RU10 versions

The above two release versions (17.2.x and 17.3.x) are affected by these vulnerabilities.

To remediate these vulnerabilities,

For the 17.2.x releases:

You must follow the resolution steps provided in this KB article.

For the 17.3.x releases:

You may follow the resolution steps provided in this KB article.

(or)

You can upgrade to CA Service Management 17.3 RU11 with the upgraded Log4j2 version of 2.16.0 to fix the security vulnerabilities affecting the Apache Log4j utility. For more information on installation of CA Service Management 17.3 RU11, refer

https://techdocs.broadcom.com/us/en/ca-enterprise-software/business-management/ca-service-management/17-3/Release-Information/CA-Service-Management-17-3-0-11-Release-Notes.html

Cause

This vulnerability affects all versions of log4j from 2.0-beta9 to 2.14.1

Resolution

If you have already performed the below steps, you can directly goto footer notes steps and perform those steps

Please follow below steps to implement the workaround to avoid the vulnerability:

CA Service Desk Manager is vulnerable to this CVE for the following components Promotion utility, Telemetry and AMS.

1. For the Promotion utility,

1. Open sdmp.log4j.properties file from $NX_ROOT\site\cfg directory.
2. Replace all occurrences of %msg%n with %msg{nolookups}%n
3. Replace all occurrences of %m %n with %m{nolookups} %n
4. Save the file.
5. In Windows, open $NX_ROOT/bin/sdmp.bat file and change the line

"%NX_JRE_INSTALL_DIR%/bin/java" -cp %LIB%/sdmp.jar

to

"%NX_JRE_INSTALL_DIR%/bin/java" -Dlog4j2.formatMsgNoLookups=true -cp %LIB%/sdmp.jar

- In Linux, open $NX_ROOT/bin/sdmp.sh file and change the line

"$NX_JRE_INSTALL_DIR/bin/java" -cp "${LIB}/sdmp.jar

to

"$NX_JRE_INSTALL_DIR/bin/java" -Dlog4j2.formatMsgNoLookups=true -cp "${LIB}/sdmp.jar

2. For the Telemetry,

Open pdm_startup.i file from $NX_ROOT\pdmconf directory and for macro SDM_TELEMETRY, change the command from

command = "$NX_JRE_INSTALL_DIR/bin/java -Djava.net.preferIPv4Stack=false

to

command = "$NX_JRE_INSTALL_DIR/bin/java -Dlog4j2.formatMsgNoLookups=true -Djava.net.preferIPv4Stack=false

Open pdm_startup.i.tpl file from $NX_ROOT\pdmconf directory and for macro SDM_TELEMETRY, change the command from

command = "$NX_JRE_INSTALL_DIR/bin/java -Djava.net.preferIPv4Stack=false

To

command = "$NX_JRE_INSTALL_DIR/bin/java -Dlog4j2.formatMsgNoLookups=true -Djava.net.preferIPv4Stack=false

3. For the AMS,

- Open log4j2.xml file from $NX_ROOT\bopcfg\www\CATALINA_BASE\webapps\AMS\WEB-INF\classes directory.
- Change the line from

to

- Open NX.env file from $NX_ROOT and change the line from

@NX_JAVA_OPTIONS=-Djava.net.preferIPv4Stack=false -Xms64M -Xmx1024M

to

@NX_JAVA_OPTIONS=-Djava.net.preferIPv4Stack=false -Xms64M -Xmx1024M -Dlog4j2.formatMsgNoLookups=true

4. Restart the SDM services.

The Common Installer/ Rollup Patch Installer also has the vulnerability, In order to mitigate this, prior to running the installer perform the following steps

Windows:

Open setup.lax file and change from

lax.nl.java.option.additional=-Djava.library.path=".\\java\\bin;" -DGET_SD_PRESETS=true

to

lax.nl.java.option.additional=-Djava.library.path=".\\java\\bin;" -DGET_SD_PRESETS=true -Dlog4j2.formatMsgNoLookups=true

Open log4j2.xml file and change the occurrences of %m%n to %m{nolookups}%n

Linux:

Open setup.sh1.lax file and change from

lax.nl.java.option.additional=-Djava.library.path="./java/bin;" -DGET_SD_PRESETS=true

to

lax.nl.java.option.additional=-Djava.library.path="./java/bin;" -DGET_SD_PRESETS=true -Dlog4j2.formatMsgNoLookups=true

Open log4j2.xml file and change the occurrences of %m%n to %m{nolookups}%n

Footer note : (Mandatory step)

Stop the CA Service Desk Manager Services.
Promotion Utility and Telemetry components uses log4j-core-*.jar from the $NX_ROOT/java/lib directory.

For Linux, navigate to $NX_ROOT/java/lib directory in the shell and run

zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class

For Windows, navigate to $NX_ROOT/java/lib directory, open the log4j-core-*.jar using WinRar/7-Zip utility and delete the JndiLookup.class from org/apache/logging/log4j/core/lookup
AMS component uses log4j-core-*.jar from the $NX_ROOT/bopcfg/www/CATALINA_BASE/webapps/AMS/WEB-INF/lib directory.

For Linux, navigate to $NX_ROOT/bopcfg/www/CATALINA_BASE/webapps/AMS/WEB-INF/lib directory in the shell and run

zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class

For Windows, navigate to $NX_ROOT/bopcfg/www/CATALINA_BASE/webapps/AMS/WEB-INF/lib directory, open the log4j-core-*.jar using WinRar/7-Zip utility and delete the JndiLookup.class from org/apache/logging/log4j/core/lookup

Please take a copy of updated log4j-core-*.jar file of AMS so that you can replace it if AMS.war gets exploded again. This war file gets exploded again if the original exploded AMS folder is deleted.

For The Common Installer/ Rollup Patch Installer,

For Linux, Navigate to the lib directory inside the DVD and run

zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class

For Windows, navigate to lib directory inside the DVD, open the log4j-core-*.jar using WinRar/7-Zip utility and delete the JndiLookup.class from org/apache/logging/log4j/core/lookup

Additional Information

If you are using Embedded Entitlements Manager (EEM), please refer to the following KB article:

https://knowledge.broadcom.com/external/article?articleId=230311

If you are using IT Process Automation (ITPAM), please refer to the following KB article:

https://knowledge.broadcom.com/external/article?articleId=230306

https://nvd.nist.gov/vuln/detail/CVE-2021-44228