CVE-2019-17571 and CVE-2021-4104.: log4j-1.2.17 Vulnerability on PIM/PAMSC endpoints

Products

• CA Privileged Access Manager - Server Control (PAMSC)

Issue/Introduction

PIM 12.8SP1 and PAMSC 14.1 Endpoints have "log4j-1.2.17" installed on them specific to an Arcot software integration feature

Based on CVE-2019-17571 and CVE-2021-4104.  this module may be vulnerable if used in certain configurations but not in our default configuration.

 

 

Environment

Privileged Identity Manager 12.8

PAM Server Control 14.x

Resolution

Assuming the Arcot integration feature is not being used the file  /opt/CA/AccessControl/lbin/java/arcot/log4j-1.2.17.jar.  can simply be removed. After reviewing this feature usage we have decided to remove this from all new installs so it will not be added back.

If you are not sure if you are using then you can assume you are not since it is a very specific feature so you would know.

If you are using this integration please contact Broadcom support and we can discuss further

.

Additional Information

https://nvd.nist.gov/vuln/detail/CVE-2019-17571

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17571

https://logging.apache.org/log4j/1.2/