Advanced Authentication( Strong Authentication/Risk Authentication) advisory for Apache Log4j vulnerability
Article ID: 230301
Updated On:
Products
Issue/Introduction
A Critical vulnerability in Apache Log4j was discovered that requires immediate attention, CVE-2021-44228, nicknamed ‘Log4Shell’. This vulnerability was discovered in Apache Log4j 2.x versions earlier than 2.17.0.
Does this have exploitable vulnerability impact on Advanced Authentication?
Environment
Release : 9.1.x
Component : RiskMinder(Arcot RiskFort) Risk Authentication
AuthMinder(Arcot WebFort) Strong Authentication
Cause
Resolution
Broadcom Inc. is continually working to improve our software and services to best meet the needs of our customers. The product team would like to inform you about the “Log4j 2 CVE-2021-44228 vulnerability” affecting the Symantec Advanced Authentication product.
Log4j Versions Affected: All versions from 2.0-beta9 to 2.16
CVE-2021-44228 Description: Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled.
Over the weekend (December 18, 2021), Apache has introduced one more vulnerability CVE-2021-45105 .
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0 and 2.12.3.
In log4j 2.17.0 this vulnerable behavior has been resolved. The Symantec Advanced Authentication product version 9.1, 9.1.01(9.1SP1) and 9.1.02(9.1SP2) would integrate with the log4j 2.17.0 and provide patches on these versions.
Fix for Advanced Authentication’s Java components was delivered on or before January 3rd 2022. Instructions to download the patches are available in the Additional information section.
Fixes released for these 3 versions.
- Advanced Authentication Version 9.1.02 ( 9.1SP2) ====> Delivered ahead of schedule (December 28th, 2021) - on Broadcom support portal in "Solution Downloads'
- Advanced Authentication Version 9.1.01( 9.1SP1) ====> Delivered ahead of schedule (December 29th, 2021) - on Broadcom support portal in "Solution Downloads'
- Advanced Authentication Version 9.1 ====> Delivered on January 3d 2022 - on Broadcom support portal in "Solution Downloads'
Note: Advanced Authentication version 8.x and 9.0.x uses Old version of log4j 1.x and hence are not vulnerable as per the analysis, please refer to the following link - http://slf4j.org/log4shell.html
Following are the vulnerabilities reported on Log4j:
Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed.
Impact on AA: Yes Advanced Authentication is impacted by this vulnerability.
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. JMSAppender is not being used in AA and hence not vulnerable.
Impact on AA: No. Advanced Authentication is not impacted by this vulnerability.
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations.
Impact on AA: Yes Advanced Authentication is impacted by this vulnerability.
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0 and 2.12.3.
Impact on AA: Yes Advanced Authentication is impacted by this vulnerability.
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
Impact on AA: No. Advanced Authentication is not impacted by this vulnerability.
Solution:
In log4j 2.17.0 impacted vulnerabilities have been resolved. The Symantec Advanced Authentication product version 9.1, 9.1.01 and 9.1.02 would integrate with the log4j 2.17.0 and patches have been provided for all three affected versions of Advanced Authentication.
As Broadcom is guided by any Apache’s (NVD -National Vulnerability Database) announcements for related CVEs, this document may be updated. Please continue to visit this KB for associated Release Dates etc. Please reach out to Support for any related questions or concerns you have.
Additional Information
Published Advisory is at this location.
Symantec Security Advisory for Log4j 2 CVE-2021-44228 Vulnerability
Apache Log4j Security Vulnerabilities are posted here.
Apache Log4j Security Vulnerabilities
Steps to upgrade/Update Advanced Authentication components from log4j version 2.17.0 ( or current version) to a newly announced remediated version.
Feedback
