vulnerabilities detected in old log4j libraries
search cancel

vulnerabilities detected in old log4j libraries

book

Article ID: 448243

calendar_today

Updated On:

Products

CA Service Management - Service Desk Manager CA Service Desk Manager

Issue/Introduction

A security scan has detected following vulnerabilities in old log4j libraries

How to remove these vulnerabilities ?

Example of old log4j files detected on a server SDM 17.4

C:\Program Files\CA\SC\Mdb\Windows\lib\log4j-1.2.13.jar1.2.13
D:\CABI_6_3\buildomatic\conf_source\iePro\lib\log4j-1.2.12.jar1.2.12
D:\CABI_6_3\buildomatic\install_resources\war\jasperserver-pro\WEB-INF\lib\log4j-1.2.12.jar1.2.12
D:\CABI_6_3\buildomatic\target\log4j-1.2.16.jar1.2.16
D:\CABI_6_3\upgrade-6.1-6.2\conf_source\iePro\lib\log4j-1.2.12.jar1.2.12
D:\CABI_6_3\upgrade-6.1-6.2\target\log4j-1.2.16.jar1.2.16
D:\ITSM14\filestore\encryption\itamlib\log4j-1.2.15.jar1.2.15
D:\ITSM14\filestore\encryption\slcmlib\log4j-1.2.15.jar1.2.15
D:\ITSM14\java\lib\log4j-1.2.15.jar1.2.15
D:\ITSM14\java\lib\log4j-1.2.8.jar1.2.8
D:\ITSM14\java\lib\smsi.jar1.2.15
D:\ITSM14\lib\log4j-1.2.15.jar1.2.15
D:\ITSM14\products\SDM\casd.nt\java\lib\log4j-1.2.15.jar1.2.15
D:\ITSM14\products\SDM\casd.nt\java\lib\log4j-1.2.8.jar1.2.8
D:\ITSM14\products\SDM\casd.nt\MDB\MSSQL\lib\log4j-1.2.13.jar1.2.13
D:\ITSM14\products\SDM\casd.nt\MDB\ORACLE\lib\log4j-1.2.13.jar1.2.13
D:\ITSM14\products\SDM\casd.nt\SAMigration\lib\log4j-1.2.8.jar1.2.8
D:\ITSM14\scripts\CDB\lib\log4j-1.2.13.jar1.2.13
D:\ITSM17\filestore\encryption\itamlib\log4j-1.2.15.jar1.2.15
D:\ITSM17\filestore\encryption\slcmlib\log4j-1.2.15.jar1.2.15
D:\ITSM17\java\lib\log4j-1.2.15.jar1.2.15
D:\ITSM17\java\lib\log4j-1.2.8.jar1.2.8
D:\ITSM17\lib\log4j-1.2.15.jar1.2.15
D:\ITSM17\products\Datamart\casm_dm\mdb_casm_dm_sql_Windows.jar1.2.13
D:\ITSM17\products\SDM\casd.nt\java\lib\log4j-1.2.15.jar1.2.15
D:\ITSM17\products\SDM\casd.nt\java\lib\log4j-1.2.8.jar1.2.8
D:\ITSM17\products\SDM\casd.nt\MDB\MSSQL\lib\log4j-1.2.13.jar1.2.13
D:\ITSM17\products\SDM\casd.nt\MDB\ORACLE\lib\log4j-1.2.13.jar1.2.13
D:\ITSM17\products\SDM\casd.nt\SAMigration\lib\log4j-1.2.8.jar1.2.8
D:\ITSM17\scripts\CDB\lib\log4j-1.2.13.jar1.2.13
D:\Program Files (x86)\CA\SC\REPLACED\mdb_backup\Windows\lib\log4j-1.2.13.jar1.2.13
D:\Program Files (x86)\CA\Service Desk Manager\add-ons\mdb\mssql\lib\log4j-1.2.13.jar1.2.13
D:\Program Files (x86)\CA\Service Desk Manager\add-ons\mdb\oracle\lib\log4j-1.2.13.jar1.2.13
D:\Program Files (x86)\CA\Service Desk Manager\patches\cum3\lib\log4j-1.2.13.jar1.2.13
D:\Program Files (x86)\CA\Service Desk Manager\REPLACED\HYD-368_CUM_C.OLD\bopcfg\www\CATALINA_BASE_FS\lib\log4j-1.2.15.jar1.2.15
D:\Program Files (x86)\CA\Service Desk Manager\REPLACED\HYD-368_CUM_C.OLD\bopcfg\www\CATALINA_BASE_REST\lib\log4j-1.2.15.jar1.2.15
D:\Program Files (x86)\CA\Service Desk Manager\REPLACED\HYD-368_CUM_C.OLD\bopcfg\www\CATALINA_BASE_SA\webapps\SupportAutomation\WEB-INF\lib\log4j-1.2.8.jar1.2.8
D:\Program Files (x86)\CA\Service Desk Manager\REPLACED\HYD-368_CUM_C.OLD\bopcfg\www\CATALINA_BASE\shared\lib\log4j-1.2.8.jar1.2.8
D:\Program Files (x86)\CA\Service Desk Manager\REPLACED\HYD-368_CUM_C.OLD\bopcfg\www\CATALINA_BASE\webapps\AMS.war1.2.17
D:\Program Files (x86)\CA\Service Desk Manager\REPLACED\HYD-368_CUM_C.OLD\bopcfg\www\wwwroot\log4j-1.2.8.jar1.2.8
D:\Program Files (x86)\CA\Service Desk Manager\REPLACED\HYD-368_CUM_C.OLD\java\lib\log4j-1.2.15.jar1.2.15
D:\Program Files (x86)\CA\Service Desk Manager\REPLACED\HYD-368_CUM_C.OLD\java\lib\log4j-1.2.8.jar1.2.8
D:\Program Files (x86)\CA\Service Desk Manager\REPLACED\HYD-368_CUM_C.OLD\samples\HealthServlet\HealthServlet.war1.2.15
D:\Program Files (x86)\CA\Service Desk Manager\REPLACED\HYD-735_CUM_C.OLD\bopcfg\www\CATALINA_BASE_REST\webapps\workflow.war1.2.17
D:\Program Files (x86)\CA\Service Desk Manager\REPLACED\HYD-735_CUM_C.OLD\samples\HealthServlet\HealthServlet.war1.2.17
D:\Program Files (x86)\CA\Service Desk Manager\REPLACED\hyd-735_tool.OLD\bopcfg\www\CATALINA_BASE_FS\lib\log4j-1.2.17.jar1.2.17
D:\Program Files (x86)\CA\Service Desk Manager\REPLACED\hyd-735_tool.OLD\bopcfg\www\CATALINA_BASE_REST\lib\log4j-1.2.17.jar1.2.17
D:\Program Files (x86)\CA\Service Desk Manager\REPLACED\hyd-735_tool.OLD\bopcfg\www\CATALINA_BASE_SA\webapps\SupportAutomation\WEB-INF\lib\log4j-1.2.17.jar1.2.17
D:\Program Files (x86)\CA\Service Desk Manager\REPLACED\hyd-735_tool.OLD\bopcfg\www\CATALINA_BASE\shared\lib\log4j-1.2.17.jar1.2.17
D:\Program Files (x86)\CA\Service Desk Manager\REPLACED\hyd-735_tool.OLD\java\lib\log4j-1.2.17.jar1.2.17
D:\Program Files (x86)\CA\Service Desk Manager\REPLACED\mdb_old\cum3\lib\log4j-1.2.13.jar1.2.13
D:\Program Files (x86)\CA\Service Desk Manager\REPLACED\Visualizer.OLD\CMDBVisualizer.war1.2.14
D:\Program Files (x86)\CA\Service Desk Manager\REPLACED\Visualizer.OLD\WEB-INF\lib\log4j-1.2.14.jar1.2.14
D:\Program Files (x86)\CA\Service Desk Manager\temp\hyd-368_cum_C\HealthServlet.war1.2.17
D:\Program Files (x86)\CA\Service Desk Manager\temp\hyd-368_cum_C\log4j-1.2.17.jar1.2.17
D:\Program Files (x86)\CA\Service Desk Manager\temp\hyd-368_cum_C\workflow.war1.2.17
D:\Program Files (x86)\CA\Service Desk Manager\temp\mdb_sql\lib\log4j-1.2.13.jar1.2.13
D:\Program Files\CA\SC\CA Business Intelligence\apache-tomcat\webapps\jasperserver-pro\WEB-INF\lib\log4j-1.2.12.jar1.2.12
D:\Program Files\CA\SC\CA Business Intelligence\buildomatic\conf_source\iePro\lib\log4j-1.2.12.jar1.2.12
D:\Program Files\CA\SC\CA Business Intelligence\buildomatic\install_resources\war\jasperserver-pro\WEB-INF\lib\log4j-1.2.12.jar1.2.12
D:\Program Files\CA\SC\CA Business Intelligence\buildomatic\target\log4j-1.2.16.jar1.2.16
D:\Program Files\CA\Service Catalog\REPLACED\CA_SLCM_r17.3.0.20.OLD\embedded\mdb\windows\mdb_usm_Windows.jar1.2.13
D:\Program Files\CA\Service Catalog\REPLACED\CA_SLCM_r17.3.0.20.OLD\fulfillment\WEK\CAFlow\client\log4j-1.2.8.jar1.2.8
D:\Program Files\CA\Service Catalog\REPLACED\CA_SLCM_r17.3.0.20.OLD\fulfillment\WEK\CAFlow\eiam\processmanager.war\WEB-INF\lib\log4j-1.2.8.jar1.2.8
D:\Program Files\CA\Service Catalog\REPLACED\CA_SLCM_r17.3.0.20.OLD\fulfillment\WEK\CAFlow\eiam\wl-web.war\WEB-INF\lib\log4j-1.2.8.jar1.2.8
D:\Program Files\CA\Service Catalog\REPLACED\CA_SLCM_r17.3.0.20.OLD\scripts\mergetenants\org.apache.jakarta_log4j.jar1.2.15
D:\Program Files\CA\Service Catalog\REPLACED\CA_SLCM_r17.3.0.20.OLD\view\scripts\MDB\mdb_usm_Windows.jar1.2.13
D:\Program Files\CA\Service Catalog\REPLACED\CA_SLCM_r17.3.OLD\view\scripts\MDB\mdb_usm_Windows.jar1.2.13
D:\Program Files\CA\Service Management Administration\REPLACED\CASMA_r17.3.0.21.OLD\apache-tomcat\webapps\casm\WEB-INF\eclipse\plugins\org.apache.jakarta_log4j.jar1.2.15

 

Environment

Service Desk 17.4

Resolution

In version 17.4 old log4j libraries affected by vulnerabilities are not used anymore.

In most cases the old log4j files could be deleted.

Here is the solutions based on the example above :

 

C:\Program Files\CA\SC\Mdb\Windows\lib\log4j-1.2.13.jarUpgrade to 17.4. If product is already is version in version 17.4, just delete this file
D:\CABI_6_3\*CABI 6.3 has been EOS for a very long time. Upgrade CA Business Intelligence JasperReports Server to version 9.0.0 (compatible with SDM 17.4)
D:\ITSM14\*Old ISO Service Management. Could be deleted if this iso source is not used anymore. In iso version 17.4 these files does not exist anymore
D:\ITSM17\*Old ISO Service Management. Could be deleted if this iso source is not used anymore. In iso version 17.4 these files does not exist anymore
D:\Program Files (x86)\CA\SC\REPLACED\*Backup made with applyptf. These files could be deleted
D:\Program Files (x86)\CA\Service Desk Manager\add-ons\mdb\*Upgrade to 17.4. If product is already is version in version 17.4, just delete these files
D:\Program Files (x86)\CA\Service Desk Manager\patches\*Backup made with applyptf. These files could be deleted
D:\Program Files (x86)\CA\Service Desk Manager\REPLACED\*Backup made with applyptf. These filse could be deleted
D:\Program Files (x86)\CA\Service Desk Manager\temp\*Files in temp directory. These files could be deleted
D:\Program Files\CA\SC\CA Business Intelligence\*CABI 6.3 has been EOS for a very long time. Upgrade CA Business Intelligence JasperReports Server to version 9.0.0 (compatible with SDM 17.4)
D:\Program Files\CA\Service Catalog\REPLACED\*Backup made with applyptf. These files could be deleted
O:\Program Files (x86)\CA\SC\REPLACED\*Backup made with applyptf. These files could be deleted
D:\Program Files\CA\Service Management Administration\REPLACED\*Backup made with applyptf. These files could be deleted

 

 

Powered by Wolken Software