Lucene search

K
ibmIBMF50A6F6BA5B32FE7E7B5465ACFA2151CE81FE9DEB6C0E87419E72E0A87BE39EA
HistoryMay 06, 2022 - 5:09 p.m.

Security Bulletin: Due to use of Apache Log4j, OmniFind Text Search Server for DB2 for i is vulnerable to arbitrary code execution (CVE-2021-4104)

2022-05-0617:09:03
www.ibm.com
10

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

6 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

Summary

There is a vulnerability in Apache Log4j (CVE-2021-4104) as described in the vulnerability details section. Apache Log4j v1 is used by OmniFind Text Search Server for DB2 for i for generating logs and diagnostic traces in some of its components. IBM has addressed the vulnerability in OmniFind Text Search Server for DB2 for i by removing Apache Log4j.

Vulnerability Details

CVEID:CVE-2021-4104
**DESCRIPTION:**Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of untrusted data when the attacker has write access to the Log4j configuration. If the deployed application is configured to use JMSAppender, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 8.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/215048 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
OmniFind Text Search Server for DB2 for i

V1R6M0
V1R5M0
V1R4M0
V1R3M0

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now.

The issue can be fixed by applying PTFs to IBM i. Releases V1R6M0(7.5), V1R5M0(7.4), V1R4M0(7.3), and V1R3M0(7.2) of OmniFind Text Search Server for DB2 for i will be fixed.

The IBM i PTF numbers containing the fix for the CVE:

OmniFind Text Search Server for DB2 for i Release IBM i Release PTF Number
V1R6M0 7.5 SI78636
SI78665
SI78673
V1R5M0 7.4 SI78753
SI78754
SI78755
V1R4M0 7.3 SI78756
SI78757
SI78758
V1R3M0 7.2 SI78751
SI78759
SI78760
SI78761

<https://www.ibm.com/support/fixcentral&gt;

Important note: IBM recommends that all users running unsupported versions of affected products upgrade to supported and fixed version of affected products.

Workarounds and Mitigations

None

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

6 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

Related for F50A6F6BA5B32FE7E7B5465ACFA2151CE81FE9DEB6C0E87419E72E0A87BE39EA