Security scans of the vCenter Appliance erroneously shows log4j-1.2.12rsa-1.jar as vulnerable.

Products

• VMware vCenter Server

Issue/Introduction

Symptoms:
A security scanner may identify log4j-1.2.12rsa-1.jar as a vulnerable version of log4j installed on a vCenter appliance.

Environment

VMware vCenter Server 7.x
VMware vCenter Server 8.x

Cause

RSA SDK version 8.6 is shipped with vCenter to enable users to login with an RSA SecurID token. log4j-1.2.12rsa-1.jar is bundled as part of this third-party SDK and cannot be modified by VMware.

Resolution

RSA has stated there are no known exploitable vulnerabilities in log4j-1.2.12rsa-1.jar. If it's still required to remove the file in the environment, see the workaround below.

 

Workaround

Before beginning, download the correct version of the remove_rsa_jars script that corresponds to the vCenter Server build.

remove_rsa_jars_80	vCenter Server 8.0.0.1 (GA) - current
remove_rsa_jars_70p09	vCenter Server 7.0.02000 (U3q) - current
remove_rsa_jars_70p06	vCenter Server 7.0.01100 (U3i) - 7.0.01800 (U3p)

 

In the steps below, the script for vCenter 8.0 is used.

      1. Take a snapshot of the vCenter VM.

      2. Download the attached script from this article and upload to the /tmp folder of the vCenter Server appliance.

      3. If the connection to upload to the vCenter by the SCP client is rejected, run this from a SSH session to the vCenter. 

      chsh -s /bin/bash

      4. Connect to the vCenter Server appliance with a SSH session if a connection has been established as per Step 2.

      5. Navigate to the /tmp directory:

  cd /tmp

      6. Run chmod +x remove_rsa_jars_80.sh to make the file executable.

      7. Run ./remove_rsa_jars_80.sh

Additional Information

Additionally, VMware announced deprecation for RSA SecurID in vCenter 7.0 u2. These files will be removed in a future version of vCenter when RSA SecurID support is also removed.

Impact/Risks:

While there are no known exploitable vulnerabilities in these jars, they can be removed to prevent further detection by scans.

Warning: These scripts interact with libraries on vCenter Servers' file system. Take an offline snapshot concurrently for all vCenter Servers in the SSO domain before running the script. Failing to do so may result in an unrecoverable error and require redeploying vCenter Server.

Notes:

• Scripts should be run on each vCenter server that is failing security scans.
• There will be a short downtime while the VC services are restarted.
• Scripts will need to be re-run after any upgrades.
• RSA SecurID logins will cease to function and will not be able to be configured afterwards.