Steps to remove the log4j.jar ( log4j 1.x) from Web Server Agents
Article ID: 239214
Updated On:
Products
Issue/Introduction
The following may contain 'log4j.jar' version 1.x:
LINUX
<Install_Dir>/CA/webagent/bin/web/APS/WEB-INF/lib/log4j.jar
<Install_Dir>/CA/webagent/bin/web/APS.war
WINDOWS
<Drive>:\<Install_Dir>\CA\webagent\win64\bin\Web\APS\WEB-INF\lib\log4j.jar
<Drive>:\<Install_Dir>\CA\webagent\win64\bin\Web\APS.war
Environment
PRODUCT: Siteminder
WEB AGENT: 12.52 SP1 CR11 and older
WEB AGENT OS: Any
Cause
The APS.war file on the Siteminder r12.52 SP01 cr11 and older Web Agent shipped with 'log4j.jar'. This is built off of lo4j 1.x.
Since Log4j 1 is no longer maintained none of the issues listed will be fixed. Users are urged to upgrade to Log4j 2. More issues will be added to this list as they are reported.
CVE-2019-17571 is a high severity issue targeting the SocketServer. Log4j includes a SocketServer that accepts serialized log events and deserializes them without verifying whether the objects are allowed or not. This can provide an attack vector that can be exploited.
CVE-2020-9488 is a moderate severity issue with the SMTPAppender. Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender.
CVE-2021-4104 is a high severity deserialization vulnerability in JMSAppender. JMSAppender uses JNDI in an unprotected manner allowing any application using the JMSAppender to be vulnerable if it is configured to reference an untrusted site or if the site referenced can be accessed by the attacker. For example, the attacker can cause remote code execution by manipulating the data in the LDAP store.
CVE-2022-23302 is a high severity deserialization vulnerability in JMSSink. JMSSink uses JNDI in an unprotected manner allowing any application using the JMSSink to be vulnerable if it is configured to reference an untrusted site or if the site referenced can be accessed by the attacker. For example, the attacker can cause remote code execution by manipulating the data in the LDAP store.
CVE-2022-23305 is a high severity SQL injection flaw in JDBCAppender that allows the data being logged to modify the behavior of the component. By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed.
CVE-2022-23307 is a critical severity against the chainsaw component in Log4j 1.x. This is the same issue corrected in CVE-2020-9493 fixed in Chainsaw 2.1.0 but Chainsaw was included as part of Log4j 1.2.x.
Resolution
NOTE: This issue only applies to the r12.52 SP01 cr11 and older web agent. This does not apply to the r12.8 and newer web agents.
OPTION #1: Upgrade to the r12.8 Web Agent
This issue has been remediated in the Siteminder r12.8 Web Agent which ships with Log4J 2.17.2 in the 'APS.war' file. Upgrading to the WebAgent to 12.8 is the recommended solution.
OPTION #2: Remove the 'APS.war' from the Web Agent
If you are not using Advanced Password Services, then you can remove the following file and directory:
LINUX
<Install_Dir>/CA/webagent/bin/web/APS.war
* <Install_Dir>/CA/webagent/bin/web/APS/
WINDOWS
<Drive>:\<Install_Dir>\CA\webagent\win64\bin\Web\APS.war
* <Drive>:\<Install_Dir>\CA\webagent\win64\bin\Web\APS\
* If Present
OPTION #3: Update the 'APS.war' file on the Web Agent
Updating the 'APS.war' File on the Siteminder Web Agent
1) Download 'APS.zip' from this KB (KB239214)
2) Copy 'APS.zip' to the web agent.
3) Decompress 'APS.zip'
Contents: APS.war
readme.txt
4) Stop the Web Server.
5) Navigate to the following directory:
<Install_Dir>/CA/webagent/bin/web/APS.war"
6) Backup the existing 'APS.war' by renaming it 'APS.war.BAK'
mv APS.war APS.war.BAK
7) (If Present) Backup the existing '/APS/' directory by renaming it '/APS-dir.BAK/'
mv APS APS-dir.BAK
8) Copy the 'APS.war' file from 'ASP.zip' to the following directory
<Install_Dir>/CA/webagent/bin/web/
9) Start the Web Server
10) Test/Validate web agent functionality
11) Delete the following:
<Install_Dir>/CA/webagent/bin/web/APS.war.BAK
* <Install_Dir>/CA/webagent/bin/web/APS-dir.BAK
* If Present
Additional Information
Attachments
Feedback
