Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBMB47B01CFCEE320F0AE033C32D22579706D0B59585EDEDF3D908CA06FA3E92084
HistoryJan 07, 2022 - 7:03 p.m.

Security Bulletin: Apache Log4j vulnerability affects IBM Secure External Authentication Server (CVE-2021-4104)

2022-01-0719:03:49
www.ibm.com
82

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.975 High

EPSS

Percentile

99.9%

JSON

Summary

IBM Sterling External Authentication Server is vulnerable to an arbitrary code execution due to Apache Log4j, which is used for logging (CVE-2021-44832). The fix upgrades all Apache Log4j 1.x to Apache Log4j 2.17.1.

Vulnerability Details

CVEID:CVE-2021-4104
**DESCRIPTION:**Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of untrusted data when the attacker has write access to the Log4j configuration. If the deployed application is configured to use JMSAppender, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 8.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/215048 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Sterling External Authentication Server 6.0.3
IBM Sterling External Authentication Server 6.0.2
IBM Sterling External Authentication Server 2.4.3.2

Remediation/Fixes

Product VRMF iFix Remediation
IBM Sterling External Authentication Server 6.0.3 iFix 01 Plus Build 141 Fix Central - 6030
IBM Sterling External Authentication Server 6.0.2 iFix 04 Plus Build 214 Fix Central - 6020
IBM Sterling External Authentication Server 2.4.3.2 iFix 13 Plus Build 296 Fix Central - 2432
This fix also remediates CVE-2021-44228, CVE-2021-45046, CVE-2021-45105 and CVE-2021-44832.

Workarounds and Mitigations

None

Related

rapid7blog 1
githubexploit 9
ibm 150
qualysblog 4
thn 4
arista 1
github 2
redhat 7
osv 1
paloalto 1
citrix 1
cisco 1
nessus 3
checkpoint_security 1
hivepro 1
securelist 1
avleonov 1
fedora 2
ics 1
trellix 2
symantec 1
cisa 1
threatpost 2
nvidia 1
rapid7blog
rapid7blog
Widespread Exploitation of Critical Remote Code Execution in Apache Log4j
2021-12-10 15:30:00
githubexploit
githubexploit
Exploit for Deserialization of Untrusted Data in Apache Log4J
2021-12-13 07:24:02
Exploit for Deserialization of Untrusted Data in Apache Log4J
2021-12-13 07:24:02
Exploit for Deserialization of Untrusted Data in Apache Log4J
2021-12-13 07:24:02
ibm
ibm
Security Bulletin: Multiple vulnerabilities in Apache Log4j affects some features of IBM® Db2® (CVE-2021-45046, CVE-2021-45105)
2022-11-11 17:20:42
Security Bulletin: Multiple vulnerabilities in Apache Log4j affect the IBM WebSphere Application Server and IBM Security Guardium Key Lifecycle Manager (CVE-2021-4104, CVE-2021-45046, CVE-2021-45105 and CVE-2021-44832)
2022-05-04 12:55:51
Security Bulletin: Vulnerablity in Apache Log4j may affect IBM Tivoli Monitoring (CVE-2021-4104)
2022-12-30 17:31:59
qualysblog
qualysblog
Is Your Web Application Exploitable By Log4Shell Vulnerability?
2021-12-15 17:06:36
New Options Profiles for Log4Shell Detection
2021-12-20 17:33:11
CVE-2021-44228: Apache Log4j2 Zero-Day Exploited in the Wild (Log4Shell)
2021-12-10 19:30:11
thn
thn
New Apache Log4j Update Released to Patch Newly Discovered Vulnerability
2021-12-29 04:59:00
Microsoft Warns of Continued Attacks Exploiting Apache Log4j Vulnerabilities
2022-01-05 05:12:00
New Local Attack Vector Expands the Attack Surface of Log4j Vulnerability
2021-12-18 12:18:00
arista
arista
Security Advisory 0070
2022-05-20 00:00:00
github
github
GitHub’s response to Log4j vulnerability CVE-2021-44228
2021-12-13 19:06:34
Security Advisory for "Log4Shell"
2022-01-21 23:25:04
redhat
redhat
(RHSA-2022:0083) Moderate: Red Hat build of Eclipse Vert.x 4.1.8 security update
2022-01-20 12:09:30
(RHSA-2022:0203) Critical: Red Hat Fuse 7.8-7.10 security update
2022-01-20 09:22:41
(RHSA-2022:0222) Moderate: Red Hat Integration Camel Extensions for Quarkus 2.2 security update
2022-01-20 18:50:57
osv
osv
Security Advisory for "Log4Shell"
2022-01-21 23:25:04
paloalto
paloalto
Impact of Log4j Vulnerabilities CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832
2021-12-10 21:45:00
citrix
citrix
Citrix Security Advisory for CVE-2021-44228, CVE-2021-45046, CVE-2021-45105 and CVE-2021-44832.
2021-12-11 17:15:50
cisco
cisco
Vulnerabilities in Apache Log4j Library Affecting Cisco Products: December 2021
2021-12-10 18:45:00
nessus
nessus
Amazon Linux 2022 : log4j (ALAS2022-2022-225)
2022-12-09 00:00:00
Oracle Primavera Gateway (Jan 2022 CPU)
2022-01-20 00:00:00
Log4Shell Ecosystem Wrapper
2021-12-14 00:00:00
checkpoint_security
checkpoint_security
Check Point's response to Apache Log4j Remote Code Execution
2021-12-10 11:28:03
hivepro
hivepro
Apache released a patch to address the critical zero-day vulnerability in log4j
2021-12-29 09:27:58
securelist
securelist
Answering Log4Shell-related questions
2021-12-20 15:45:30
avleonov
avleonov
Log4j “Log4Shell” RCE explained (CVE-2021-44228)
2021-12-26 22:07:17
fedora
fedora
[SECURITY] Fedora 34 Update: log4j-2.17.0-1.fc34
2021-12-27 00:56:30
[SECURITY] Fedora 35 Update: log4j-2.17.0-1.fc35
2021-12-27 00:41:40
ics
ics
Mitigating Log4Shell and Other Log4j-Related Vulnerabilities
2021-12-23 12:00:00
trellix
trellix
Log4shell Vulnerability is the Coal in Our Stocking for 2021
2022-01-19 00:00:00
Log4shell Vulnerability is the Coal in Our Stocking for 2021
2022-01-19 00:00:00
symantec
symantec
Symantec Security Advisory for Log4j Vulnerability
2021-12-11 01:06:47
cisa
cisa
Mitigating Log4Shell and Other Log4j-Related Vulnerabilities
2021-12-22 00:00:00
threatpost
threatpost
Third Log4J Bug Can Trigger DoS; Apache Issues Patch
2021-12-20 16:01:57
Apache’s Fix for Log4Shell Can Lead to DoS Attacks
2021-12-15 14:04:19
nvidia
nvidia
Security Notice: NVIDIA Response to Log4j Vulnerabilities - December 2021
2021-12-13 00:00:00

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.975 High

EPSS

Percentile

99.9%

JSON
Related for B47B01CFCEE320F0AE033C32D22579706D0B59585EDEDF3D908CA06FA3E92084
rapid7blog1githubexploit9ibm150qualysblog4thn4arista1github2redhat7osv1paloalto1citrix1cisco1nessus3checkpoint_security1hivepro1securelist1avleonov1fedora2ics1trellix2symantec1cisa1threatpost2nvidia1