The Apache Log4j2 CVE-2021-44228 Remote Code Execution Vulnerability Was Publicly Disclosed and Huawei Security Products Have Been Able to Handle It

Release Date ： 2021-12-10 11:40:32 Update Date ： 2021-12-15 17:31:15 Author ：

【Abstract】On December 9th, 2021, Huawei found that the Apache Log4j2 remote code execution vulnerability was publicly disclosed and that the PoC for this vulnerability appeared on the Internet. The vulnerability has a wide range of impacts and is not hard to exploit. Successful exploitation results in remote arbitrary code execution.

Vulnerability Overview

On December 9th, 2021, Huawei found that the Apache Log4j2 remote code execution vulnerability was publicly disclosed and that the PoC for this vulnerability appeared on the Internet. The vulnerability has a wide range of impacts and is not hard to exploit. Successful exploitation results in remote arbitrary code execution. Therefore, it is strongly recommended that you upgrade the component version or use the solution provided in this notice to avoid hacker attacks. Huawei security products have released IPS signatures to support the handling of such a vulnerability.

Affected Versions

Log4j all versions from 2.0-beta9 through 2.12.1 and 2.13.0 through 2.14.1

Troubleshooting Method

Check the Apache Log4j version, and perform operations for the involved version.

Solution

1. Huawei solution

Since Huawei detected this vulnerability, security research engineers have been paying close attention to the vulnerability information and immediately developed corresponding IPS signatures. The latest IPS signature database has been pushed to the upgrade website for customers to upgrade.

Item	Description	Remarks
IPS signature database version	20211213**	** indicates the code of a different model library. Versions later than this version can protect against this vulnerability.
Signature ID	712110/712111/712112/712113: Apache Log4j2 CVE-2021-44228 Remote Code Execution Vulnerability
Supported devices	USG6000/6000E/9000 series, Eudemon8000E/9000E series, NIP6000 series, IPS60000/12000 series and later series	For details, see the IPS signature database download website.
Automatic upgrade	Devices with Internet access can be upgraded automatically without manual operation. It is recommended that you log in to the device to manually upgrade the signature database immediately. (Refer to the attachment for the operation method.)	You can check whether the IPS signature database version has been upgraded to the latest version on the device.
Manual upgrade	Download the offline upgrade package from https://isecurity.huawei.com/sec/web/urlClassification.do and manually install it on the device.

2. Vendor solution

(1) Install the official patch to upgrade the Log4j version. The link is as follows:

https://github.com/apache/logging-log4j2/archive/refs/tags/rel/2.12.2.zip

https://github.com/apache/logging-log4j2/archive/refs/tags/rel/2.16.0.zip

(2) Temporary workaround

1. Set the JVM parameter -Dlog4j2.formatMsgNoLookups=true.

2. Set log4j2.formatMsgNoLookups=True.

3. Set the system environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true.

References

https://logging.apache.org/log4j/2.x/security.html

Attachment:

Immediate upgrade operation mode:

【Copyright Notice】 This article is the original content of HUAWEI Security Center. When reprinting, you must indicate the source (HUAWEI Security Center), link and author of the article, otherwise you may be held liable.If you find any suspected infringing content on this website, please visit the Feedback page to report and provide relevant evidence. Once verified, we will immediately remove the allegedly infringing content.

BackTop

Comment

9	0
Like	Disagree

Security Notice

Research

Signature Update

Knowledge Base Query

Intelligence Query

FireHunter-Cloud FireHunter-Cloud

My Device

Support

The Apache Log4j2 CVE-2021-44228 Remote Code Execution Vulnerability Was Publicly Disclosed and Huawei Security Products Have Been Able to Handle It