10 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.975 High
EPSS
Percentile
99.9%
Vulnerabilities in Apache Log4j could result in a denial of service or remote code execution. These vulnerabilities may impact the IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Virtual Environments due to their uses of Apache Log4j for logging of messages and traces. The below fix packages include Apache Log4j 2.17.
CVEID:CVE-2021-45105
**DESCRIPTION:**Apache Log4j is vulnerable to a denial of service, caused by the failure to protect from uncontrolled recursion from self-referential lookups. A remote attacker with control over Thread Context Map (MDC) input data could craft malicious input data that contains a recursive lookup to cause a StackOverflowError that will terminate the process. Note: The vulnerability is also called LOG4J2-3230.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/215647 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID:CVE-2021-45046
**DESCRIPTION:**Apache Log4j could result in remote code execution, caused by an incomplete fix of CVE-2021-44228 in certain non-default configurations. When the logging configuration uses a non-default Pattern Layout with a Context Lookup, an attacker with control over Thread Context Map (MDC) input data can craft malicious input data using a JNDI Lookup pattern to leak sensitive information and remote code execution in some environments and local code execution in all environments.
CVSS Base score: 9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/215195 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Affected Product(s) | Version(s) |
---|---|
IBM Spectrum Protect Backup-Archive Client - see Note 1 |
8.1.11.0-8.1.13.1
7.1.8.10-7.1.8.13
IBM Spectrum Protect for Virtual Environments: Data Protection for VMware| 8.1.11.0-8.1.13.1 see Note 2
7.1.8.10-7.1.8.13
IBM Spectrum Protect for Virtual Environments: Data Protection for Hyper-V| 8.1.11.0-8.1.13.1 see Note 2
Note 1:
IBM Spectrum Protect includes the client and server. The IBM Spectrum Protect Backup-Archive Client installs the affected Apache Log4j files. Based on current analysis and information, only the Web GUI will use the affected files.
Note 2:
The Data Movers in 8.1.11 and above are affected.
IBM strongly recommends addressing these vulnerabilities now by upgrading to the fixed level instead of using the manual process described under Workarounds and Mitigations.
Note: The below fix packages include Apache Log4j 2.17.
_IBM Spectrum Protect Backup-Archive Client Affected Versions
_|Fixing
Level|Platform|_Link to Fix and Instructions
_
—|—|—|—
8.1.11.0-8.1.13.1 | 8.1.13.2| AIX
Linux
Windows| <https://www.ibm.com/support/pages/node/589103>
7.1.8.10-7.1.8.13|
7.1.8.14
| Linux
Windows|
<https://www.ibm.com/support/pages/node/316619>
_IBM Spectrum Protect for Virtual Environments: Data Protection for VMware Affected Versions
_|Fixing
Level|Platform|_Link to Fix and Instructions
_
—|—|—|—
8.1.11.0-8.1.13.1 | 8.1.13.2| Linux
Windows| https://www.ibm.com/support/pages/node/6487157
7.1.8.10-7.1.8.13| 7.1.8.14| Linux
Windows| <https://www.ibm.com/support/pages/node/316625>
_IBM Spectrum Protect for Virtual Environments: Data Protection for Hyper-V Affected Versions
_|Fixing
Level|Platform|_Link to Fix and Instructions
_
—|—|—|—
8.1.11.0-8.1.13.1| 8.1.13.2| Windows| <https://www.ibm.com/support/pages/node/6487157>
IBM strongly recommends addressing this vulnerability now by upgrading to the fixed level using the links provided in the Remediation/Fixes section instead of using the manual process below.
Procedure to Manually Replace log4j jar files
The following products/components can use this procedure:
The five impacted components are:
Component
|
Products Using Component
—|—
vmcli
|
IBM Spectrum Protect for Virtual Environments: Data Protection for VMware
File Restore
|
IBM Spectrum Protect for Virtual Environments: Data Protection for VMware, IBM Spectrum Protect for Virtual Environments: Data Protection for Hyper-V, and the Data Movers used by IBM Spectrum Protect for Virtual Environments
Data Protection for VMware UI
|
IBM Spectrum Protect for Virtual Environments: Data Protection for VMware
vCloud Suite SDK (tagging)
|
IBM Spectrum Protect for Virtual Environments: Data Protection for VMware
Web GUI
|
IBM Spectrum Protect Backup-Archive Client
The Web GUI is tied to the following items in the IBM Spectrum Protect Backup-Archive Client -
>Directions to replace the log4j jars files:
Windows steps –
1. Download the following from Apache - Apache Log4j 2.17 or later can be used.
Apache Log4j 2.17 is used in these directions as an example.
Apache Log4j 2 binary(zip): apache-log4j-2.17.0-bin.zip
<https://logging.apache.org/log4j/2.0/download.html>
2. In Windows Services, switch the following services if present to manual to avoid automatic restarts during patching process:
IBM Spectrum Protect for Virtual Environments Derby Database(vmcli)
IBM Spectrum Protect for Virtual Environments Web Server
IBM Spectrum Protect for BAClient Web Server
IBM Spectrum Protect Recovery Agent
3. Stop the following Windows services if present:
IBM Spectrum Protect for Virtual Environments Derby Database(vmcli)
IBM Spectrum Protect for Virtual Environments Web Server
IBM Spectrum Protect for BAClient Web Server
IBM Spectrum Protect Recovery Agent
4. Unzip the apache-log4j-2.17.0-bin.zip file
5. Remove the following log4j files from the following locations:
C:\IBM\SpectrumProtect\webserver\usr\servers\veProfile\apps\FR_API.war\WEB-INF\lib
C:\Program Files\IBM\SpectrumProtect\Framework\VEGUI\Lib
C:\Program Files\Tivoli\TSM\baclient\plugins\vcloudsuite\sdk
Note: Given the potential for the IBM Spectrum Protect Backup-Archive Client to be installed in a non-default location, it may be beneficial to simply search against locations of log4j*.jar and remove prior versions accordingly against locations where Spectrum Protect has placed these files.
The files to be removed are the following:
For 8.1.11.0-8.1.13.0 and 7.1.8.10-7.1.8.12
log4j-api-2.13.3.jar
log4j-1.2-api-2.13.3.jar
log4j-core-2.13.3.jar
log4j-jcl-2.13.3.jar
log4j-slf4j-impl-2.13.3.jar
For 8.1.13.1 and 7.1.8.13
log4j-api-2.15.0.jar
log4j-1.2-api-2.15.0.jar
log4j-core-2.15.0.jar
log4j-jcl-2.15.0.jar
log4j-slf4j-impl-2.15.0.jar
6. For the workarea folder locations, for example:
C:\IBM\SpectrumProtect\webserver\usr\servers\veProfile\workarea\org.eclipse.osgi\90\data\cacheAdapt\com.ibm.ws.app.manager_60\WEB-INF\lib
C:\IBM\SpectrumProtect\webserver\usr\servers\veProfile\workarea\org.eclipse.osgi\90\data\cacheAdapt\com.ibm.ws.app.manager_68\WEB-INF\lib
C:\IBM\SpectrumProtect\webserver\usr\servers\veProfile\workarea\org.eclipse.osgi\90\data\cacheOverlay\com.ibm.ws.app.manager_67\WEB-INF\lib\.cache
C:\IBM\SpectrumProtect\webserver\usr\servers\veProfile\workarea\org.eclipse.osgi\90\data\cacheOverlay\com.ibm.ws.app.manager_68\WEB-INF\lib\.cache
Folders with the log4j jar names will be created, for example:
C:\IBM\SpectrumProtect\webserver\usr\servers\veProfile\workarea\org.eclipse.osgi\90\data\cacheAdapt\com.ibm.ws.app.manager_60\WEB-INF\lib\log4j-1.2-api-2.13.3.jar\
Please remove these folders in the workarea location. The values specified by _XY will vary, for example _60 vs _67:
C:\IBM\SpectrumProtect\webserver\usr\servers\veProfile\workarea\org.eclipse.osgi\90\data\cacheAdapt\com.ibm.ws.app.manager_60\WEB-INF\lib
C:\IBM\SpectrumProtect\webserver\usr\servers\veProfile\workarea\org.eclipse.osgi\90\data\cacheAdapt\com.ibm.ws.app.manager_67\WEB-INF\lib
7. Replace the removed files with the updated versions from the zip file where they are 2.17 or later.
log4j-api-2.17.0.jar
log4j-1.2-api-2.17.0.jar
log4j-core-2.17.0.jar
log4j-jcl-2.17.0.jar
log4j-slf4j-impl-2.17.0.jar
8. Restart the following services where applicable:
IBM Spectrum Protect for Virtual Environments Derby Database (vmcli)
IBM Spectrum Protect for Virtual Environments Web Server
IBM Spectrum Protect Recovery Agent
IBM Spectrum Protect for BAClient Web Server
9. In Windows Services, switch the following services back to automatic to allow automatic restarts on reboot as needed:
IBM Spectrum Protect for Virtual Environments Derby Database(vmcli)
IBM Spectrum Protect for Virtual Environments Web Server
IBM Spectrum Protect Recovery Agent
IBM Spectrum Protect for BAClient Web Server
Linux steps –
1. Download the following from Apache - Apache Log4j 2.17 or later can be used.
Apache Log4j 2.17 is used in these directions as an example.
Apache Log4j 2 binary(zip): apache-log4j-2.17.0-bin.tar.gz
<https://logging.apache.org/log4j/2.0/download.html>
2. Stop the following services if present:
systemctl stop webserver / [SLES 12.3: /etc/init.d/webserver stop]
kill the vmclid process –> not for Web 3.0
3. Extract the files from apache-log4j-2.17.0-bin.tar.gz
4. Remove the following log4j files from the following locations:
/opt/tivoli/tsm/tdpvmware/common/webserver/usr/servers/veProfile/apps/FR_API.war/WEB-INF/lib/
/opt/tivoli/tsm/tdpvmware/common/webserver/usr/servers/veProfile/apps/tsmVmGUI.war/WEB-INF/lib/
/opt/tivoli/tsm/tdpvmware/common/lib/
/opt/tivoli/tsm/client/ba/bin/plugins/vcloudsuite/sdk/
/opt/tivoli/tsm/tdpvmware/common/webserver/usr/servers/veProfile/workarea/org.eclipse.osgi/88/data/cacheAdapt/com.ibm.ws.app.manager_51/WEB-INF/lib/
/opt/tivoli/tsm/tdpvmware/common/webserver/usr/servers/veProfile/workarea/org.eclipse.osgi/88/data/cacheOverlay/com.ibm.ws.app.manager_51/WEB-INF/lib/.cache/
Note: Given the potential for the B/A Client to be installed in a non-default location, it may be beneficial to simply search against locations of log4j*.jar and remove prior versions accordingly against locations where Spectrum Protect has placed these files. For the workarea folders listed above, the values may vary.
The files to be removed are the following:
For 8.1.11.0-8.1.13.0 and 7.1.8.10-7.1.8.12
log4j-api-2.13.3.jar
log4j-1.2-api-2.13.3.jar
log4j-core-2.13.3.jar
log4j-jcl-2.13.3.jar
log4j-slf4j-impl-2.13.3.jar
For 8.1.13.1 and 7.1.8.13
log4j-api-2.15.0.jar
log4j-1.2-api-2.15.0.jar
log4j-core-2.15.0.jar
log4j-jcl-2.15.0.jar
log4j-slf4j-impl-2.15.0.jar
5. Replace the removed files with the updated versions from the tar.gz file where they are 2.17 or later.
log4j-api-2.17.0.jar
log4j-1.2-api-2.17.0.jar
log4j-core-2.17.0.jar
log4j-jcl-2.17.0.jar
log4j-slf4j-impl-2.17.0.jar
6. Start the stopped services:
vmclid daemon
“systemctl start webserver” / [SLES 12.3: /etc/init.d/webserver start]
AIX steps –
1. Download the following from Apache - Apache Log4j 2.17 or later can be used.
Apache Log4j 2.17 is used in these directions as an example.
Apache Log4j 2 binary(zip): apache-log4j-2.17.0-bin.tar.gz
<https://logging.apache.org/log4j/2.0/download.html>
2. Stop the following process as root via the following command:
/usr/tivoli/tsm/tdpvmware/common/webserver/bin/server stop veProfile
3. Extract the files from apache-log4j-2.17.0-bin.tar.gz
4. Remove the following log4j files from the following locations:
/usr/tivoli/tsm/tdpvmware/common/webserver/usr/servers/veProfile/apps/FR_API.war/WEB-INF/lib/
/usr/tivoli/tsm/tdpvmware/common/lib/
/usr/tivoli/tsm/tdpvmware/common/webserver/usr/servers/veProfile/workarea/org.eclipse.osgi/88/data/cacheAdapt/com.ibm.ws.app.manager_51/WEB-INF/lib/
/usr/tivoli/tsm/tdpvmware/common/webserver/usr/servers/veProfile/workarea/org.eclipse.osgi/88/data/cacheOverlay/com.ibm.ws.app.manager_51/WEB-INF/lib/.cache/
Note: Given the potential for the B/A Client to be installed in a non-default location, it may be beneficial to simply search against locations of log4j*.jar and remove prior versions accordingly against locations where Spectrum Protect has placed these files. For the workarea folders listed above, the values may vary.
The files to be removed are the following:
For 8.1.11.0-8.1.13.0 and 7.1.8.10-7.1.8.12
log4j-api-2.13.3.jar
log4j-1.2-api-2.13.3.jar
log4j-core-2.13.3.jar
log4j-jcl-2.13.3.jar
log4j-slf4j-impl-2.13.3.jar
For 8.1.13.1 and 7.1.8.13
log4j-api-2.15.0.jar
log4j-1.2-api-2.15.0.jar
log4j-core-2.15.0.jar
log4j-jcl-2.15.0.jar
log4j-slf4j-impl-2.15.0.jar
5. Replace the removed files with the updated versions from the tar.gz file where they are 2.17 or later.
log4j-api-2.17.0.jar
log4j-1.2-api-2.17.0.jar
log4j-core-2.17.0.jar
log4j-jcl-2.17.0.jar
log4j-slf4j-impl-2.17.0.jar
6. Start the stopped process as root via the following command:
/usr/tivoli/tsm/tdpvmware/common/webserver/bin/server start veProfile --clean
10 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.975 High
EPSS
Percentile
99.9%