logo
DATABASE RESOURCES PRICING ABOUT US

Security Bulletin: Vulnerability in Apache Log4j affects IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Virtual Environments (CVE-2021-44228)

Description

## Summary A vulnerability in Apache Log4j could allow an attacker to execute arbitrary code on the system. This vulnerability may affect the IBM Spectrum Protect Client Web GUI and IBM Spectrum Protect for Virtual Environments due to their uses of Log4j for logging of messages and traces. ## Vulnerability Details ** CVEID: **[CVE-2021-44228](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228>) ** DESCRIPTION: **Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by the failure to protect against attacker controlled LDAP and other JNDI related endpoints by JNDI features. By sending a specially crafted code string, an attacker could exploit this vulnerability to load arbitrary Java code on the server and take complete control of the system. Note: The vulnerability is also called Log4Shell or LogJam. CVSS Base score: 10 CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/214921](<https://exchange.xforce.ibmcloud.com/vulnerabilities/214921>) for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) ## Affected Products and Versions **Affected Product(s)**| **Version(s)** ---|--- IBM Spectrum Protect Backup-Archive Client - see Note 1| 8.1.11.0-8.1.13.0 7.1.8.10-7.1.8.12 IBM Spectrum Protect for Virtual Environments: Data Protection for VMware| 8.1.11.0-8.1.13.0 see Note 2 7.1.8.10-7.1.8.12 IBM Spectrum Protect for Virtual Environments: Data Protection for Hyper-V| 8.1.11.0-8.1.13.0 see Note 2 Note 1: The IBM Spectrum Protect Backup-Archive Client installs the affected log4j files. However, only the Web GUI will use the affected log4j files. Note 2: The Data Movers in 8.1.11 and above are affected ## Remediation/Fixes IBM strongly recommends addressing this vulnerability now by upgrading to the fixed level instead of using the manual process described under Workarounds and Mitigations. **Note: The below fix packages included Log4j 2.15.** **_IBM Spectrum Protect Client Affected Versions _**| **_Fixing Level_**| **_Platform_**| **_Link to Fix and Instructions _** ---|---|---|--- 8.1.11.0-8.1.13.0 | 8.1.13.1| AIX Linux Windows| <https://www.ibm.com/support/pages/node/589103> 7.1.8.10-7.1.8.12| 7.1.8.13 | Linux Windows| <https://www.ibm.com/support/pages/node/316619> **_IBM Spectrum Protect for Virtual Environments: Data Protection for VMware Affected Versions _**| **_Fixing Level_**| **_Platform_**| **_Link to Fix and Instructions _** ---|---|---|--- 8.1.11.0-8.1.13.0 | 8.1.13.1| Linux Windows| [https://www.ibm.com/support/pages/node/6487157 ](<https://www.ibm.com/support/pages/node/6487157> "https://www.ibm.com/support/pages/node/6487157" ) 7.1.8.10-7.1.8.12| 7.1.8.13| Linux Windows| <https://www.ibm.com/support/pages/node/316625> **_IBM Spectrum Protect for Virtual Environments: Data Protection for Hyper-V Affected Versions _**| **_Fixing Level_**| **_Platform_**| **_Link to Fix and Instructions _** ---|---|---|--- 8.1.11.0-8.1.13.0| 8.1.13.1| Windows| <https://www.ibm.com/support/pages/node/6487157> ## Workarounds and Mitigations Procedure to Manually Replace log4j jar files The following products can use this procedure: \- IBM Spectrum Protect for Virtual Environments: Data Protection for VMware \- IBM Spectrum Protect for Virtual Environments: Data Protection for Hyper-V \- IBM Spectrum Protect Backup-Archive (B/A) Clients and Data Movers The five impacted components are: **Component** | **Products Using Component** ---|--- vmcli | Data Protection for VMware File Restore | Data Protection for VMware, Data Protection for Hyper-V, and Data Movers Data Protection for VMware UI | Data Protection for VMware vCloud Suite SDK (tagging) | Data Protection for VMware Web GUI | B/A Clients The Web GUI is tied to the following items in the B/A Client - Windows – “Client Web Server” feature Linux - TIVsm-WEBGUI** package AIX - tivoli.tsm.client.webgui fileset Directions to replace the log4j jars files: Windows – 1\. Download the following from Apache - Apache Log4j 2.15 or later can be used. Apache Log4j 2.15 is used in these directions as an example. Apache Log4j 2 binary(zip): apache-log4j-2.15.0-bin.zip [https://logging.apache.org/log4j/2.0/download.html](<https://logging.apache.org/log4j/2.0/download.html>) 2\. In Windows Services, switch the following services if present to manual to avoid automatic restarts during patching process: IBM Spectrum Protect for Virtual Environments Derby Database(vmcli) IBM Spectrum Protect for Virtual Environments Web Server IBM Spectrum Protect for BAClient Web Server IBM Spectrum Protect Recovery Agent 3\. Stop the following Windows services if present: IBM Spectrum Protect for Virtual Environments Derby Database(vmcli) IBM Spectrum Protect for Virtual Environments Web Server IBM Spectrum Protect for BAClient Web Server IBM Spectrum Protect Recovery Agent 4\. Unzip the apache-log4j-2.15.0-bin.zip file 5\. Remove the following log4j files from the following locations: C:\IBM\SpectrumProtect\webserver\usr\servers\veProfile\apps\FR_API.war\WEB-INF\lib C:\Program Files\IBM\SpectrumProtect\Framework\VEGUI\Lib C:\Program Files\Tivoli\TSM\baclient\plugins\vcloudsuite\sdk Note: Given the potential for the B/A Client to be installed in a non-default location, it may be beneficial to simply search against locations of log4j*.jar and remove prior versions accordingly against locations where Spectrum Protect has placed these files. The files to be removed are the following: log4j-api-2.13.3.jar log4j-1.2-api-2.13.3.jar log4j-core-2.13.3.jar log4j-jcl-2.13.3.jar log4j-slf4j-impl-2.13.3.jar 6\. For the workarea folder locations, for example: C:\IBM\SpectrumProtect\webserver\usr\servers\veProfile\workarea\org.eclipse.osgi\90\data\cacheAdapt\com.ibm.ws.app.manager_60\WEB-INF\lib C:\IBM\SpectrumProtect\webserver\usr\servers\veProfile\workarea\org.eclipse.osgi\90\data\cacheAdapt\com.ibm.ws.app.manager_68\WEB-INF\lib C:\IBM\SpectrumProtect\webserver\usr\servers\veProfile\workarea\org.eclipse.osgi\90\data\cacheOverlay\com.ibm.ws.app.manager_67\WEB-INF\lib\\.cache C:\IBM\SpectrumProtect\webserver\usr\servers\veProfile\workarea\org.eclipse.osgi\90\data\cacheOverlay\com.ibm.ws.app.manager_68\WEB-INF\lib\\.cache Folders with the log4j jar names will be created, for example: C:\IBM\SpectrumProtect\webserver\usr\servers\veProfile\workarea\org.eclipse.osgi\90\data\cacheAdapt\com.ibm.ws.app.manager_60\WEB-INF\lib\log4j-1.2-api-2.13.3.jar\ Please remove these folders in the workarea location. The values specified by _XY will vary, for example _60 vs _67: C:\IBM\SpectrumProtect\webserver\usr\servers\veProfile\workarea\org.eclipse.osgi\90\data\cacheAdapt\com.ibm.ws.app.manager_60\WEB-INF\lib C:\IBM\SpectrumProtect\webserver\usr\servers\veProfile\workarea\org.eclipse.osgi\90\data\cacheAdapt\com.ibm.ws.app.manager_67\WEB-INF\lib 7\. Replace the removed files with the updated versions from the zip file where they are 2.15 or later. log4j-api-2.15.0.jar log4j-1.2-api-2.15.0.jar log4j-core-2.15.0.jar log4j-jcl-2.15.0.jar log4j-slf4j-impl-2.15.0.jar 8\. Restart the following services where applicable: IBM Spectrum Protect for Virtual Environments Derby Database(vmcli) IBM Spectrum Protect for Virtual Environments Web Server IBM Spectrum Protect Recovery Agent IBM Spectrum Protect for BAClient Web Server 9\. In Windows Services, switch the following services back to automatic to allow automatic restarts on reboot as needed: IBM Spectrum Protect for Virtual Environments Derby Database(vmcli) IBM Spectrum Protect for Virtual Environments Web Server IBM Spectrum Protect Recovery Agent IBM Spectrum Protect for BAClient Web Server Linux – 1\. Download the following from Apache - Apache Log4j 2.15 or later can be used. Apache Log4j 2.15 is used in these directions as an example. Apache Log4j 2 binary(zip): apache-log4j-2.15.0-bin.tar.gz [https://logging.apache.org/log4j/2.0/download.html](<https://logging.apache.org/log4j/2.0/download.html>) 2\. Stop the following services if present: systemctl stop webserver / [SLES 12.3: /etc/init.d/webserver stop] kill the vmclid process --> not for Web 3.0 3\. Extract the files from apache-log4j-2.15.0-bin.tar.gz 4\. Remove the following log4j files from the following locations: /opt/tivoli/tsm/tdpvmware/common/webserver/usr/servers/veProfile/apps/FR_API.war/WEB-INF/lib/ /opt/tivoli/tsm/tdpvmware/common/webserver/usr/servers/veProfile/apps/tsmVmGUI.war/WEB-INF/lib/ /opt/tivoli/tsm/tdpvmware/common/lib/ /opt/tivoli/tsm/client/ba/bin/plugins/vcloudsuite/sdk/ /opt/tivoli/tsm/tdpvmware/common/webserver/usr/servers/veProfile/workarea/org.eclipse.osgi/88/data/cacheAdapt/com.ibm.ws.app.manager_51/WEB-INF/lib/ /opt/tivoli/tsm/tdpvmware/common/webserver/usr/servers/veProfile/workarea/org.eclipse.osgi/88/data/cacheOverlay/com.ibm.ws.app.manager_51/WEB-INF/lib/.cache/ Note: Given the potential for the B/A Client to be installed in a non-default location, it may be beneficial to simply search against locations of log4j*.jar and remove prior versions accordingly against locations where Spectrum Protect has placed these files. For the workarea folders listed above, the values may vary. The files to be removed are the following: log4j-api-2.13.3.jar log4j-1.2-api-2.13.3.jar log4j-core-2.13.3.jar log4j-jcl-2.13.3.jar log4j-slf4j-impl-2.13.3.jar 5\. Replace the removed files with the updated versions from the tar.gz file where they are 2.15 or later. log4j-api-2.15.0.jar log4j-1.2-api-2.15.0.jar log4j-core-2.15.0.jar log4j-jcl-2.15.0.jar log4j-slf4j-impl-2.15.0.jar 6\. Start the stopped services: vmclid daemon "systemctl start webserver" / [SLES 12.3: /etc/init.d/webserver start] AIX – 1\. Download the following from Apache - Apache Log4j 2.15 or later can be used. Apache Log4j 2.15 is used in these directions as an example. Apache Log4j 2 binary(zip): apache-log4j-2.15.0-bin.tar.gz [https://logging.apache.org/log4j/2.0/download.html](<https://logging.apache.org/log4j/2.0/download.html>) 2\. Stop the following process as root via the following command: /usr/tivoli/tsm/tdpvmware/common/webserver/bin/server stop veProfile 3\. Extract the files from apache-log4j-2.15.0-bin.tar.gz 4\. Remove the following log4j files from the following locations: /usr/tivoli/tsm/tdpvmware/common/webserver/usr/servers/veProfile/apps/FR_API.war/WEB-INF/lib/ /usr/tivoli/tsm/tdpvmware/common/lib/ /usr/tivoli/tsm/tdpvmware/common/webserver/usr/servers/veProfile/workarea/org.eclipse.osgi/88/data/cacheAdapt/com.ibm.ws.app.manager_51/WEB-INF/lib/ /usr/tivoli/tsm/tdpvmware/common/webserver/usr/servers/veProfile/workarea/org.eclipse.osgi/88/data/cacheOverlay/com.ibm.ws.app.manager_51/WEB-INF/lib/.cache/ Note: Given the potential for the B/A Client to be installed in a non-default location, it may be beneficial to simply search against locations of log4j*.jar and remove prior versions accordingly against locations where Spectrum Protect has placed these files. For the workarea folders listed above, the values may vary. The files to be removed are the following: log4j-api-2.13.3.jar log4j-1.2-api-2.13.3.jar log4j-core-2.13.3.jar log4j-jcl-2.13.3.jar log4j-slf4j-impl-2.13.3.jar 5\. Replace the removed files with the updated versions from the tar.gz file where they are 2.15 or later. log4j-api-2.15.0.jar log4j-1.2-api-2.15.0.jar log4j-core-2.15.0.jar log4j-jcl-2.15.0.jar log4j-slf4j-impl-2.15.0.jar 6\. Start the stopped process as root via the following command: /usr/tivoli/tsm/tdpvmware/common/webserver/bin/server start veProfile --clean ## Get Notified about Future Security Bulletins Subscribe to [My Notifications](< http://www-01.ibm.com/software/support/einfo.html>) to be notified of important product support alerts like this. ### References [Complete CVSS v3 Guide](<http://www.first.org/cvss/user-guide> "Link resides outside of ibm.com" ) [On-line Calculator v3](<http://www.first.org/cvss/calculator/3.0> "Link resides outside of ibm.com" ) Off ## Related Information [IBM Secure Engineering Web Portal](<http://www.ibm.com/security/secure-engineering/bulletins.html>) [IBM Product Security Incident Response Blog](<http://www.ibm.com/blogs/psirt>) ## Acknowledgement ## Change History 15 December 2021: Initial Publication 16 December 2021: Added note about having to upgrade to the latest release if 8.1.10 or lower is being used. 17 December 2021: Updated Remediation/Fixes section to include fix. 18 December 2021: Corrected Affected 8.1 levels 20 December 2021: Updated Remediation/Fixes section to indicate that all fix packages included Log4j 2.15. 20 December 2021: Updated Procedure to Manually Replace log4j jar files under the Workarounds and Mitigations section *The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin. ## Disclaimer Review the [IBM security bulletin disclaimer and definitions](<https://www.ibm.com/support/pages/node/6610583#disclaimer>) regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment. ## Document Location Worldwide [{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SSERB6","label":"IBM Spectrum Protect for Virtual Environments"},"Component":"","Platform":[{"code":"PF016","label":"Linux"},{"code":"PF033","label":"Windows"}],"Version":"8.1, 7.1","Edition":"","Line of Business":{"code":"LOB26","label":"Storage"}},{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SSEQVQ","label":"IBM Spectrum Protect"},"Component":"Client","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF016","label":"Linux"},{"code":"PF033","label":"Windows"}],"Version":"8.1, 7.1","Edition":"","Line of Business":{"code":"LOB26","label":"Storage"}}]


Affected Software


CPE Name Name Version
ibm spectrum protect for virtual environments 8.1
ibm spectrum protect for virtual environments 7.1
ibm spectrum protect 8.1
ibm spectrum protect 7.1

Related