Vulnerability Remediation - Revision history

Masnes: /* Lingoport's Response to Major Software Vulnerabilities */

2022-01-21T16:36:03Z

Lingoport's Response to Major Software Vulnerabilities

← Older revision		Revision as of 16:36, 21 January 2022
Line 166:		Line 166:

	==== 5. Check the status after the fix ====		==== 5. Check the status after the fix ====
	You may wish to run the check script from #1 a second time to validate the fix.		You may wish to run the check script from #2 a second time to validate the fix.
	Please note that the log4j 1.x are being worked on for our upcoming release (codename 'Ireland').		Please note that the log4j 1.x are being worked on for our upcoming release (codename 'Ireland').

Masnes: /* 1. Remove previous patch files, if any */

2021-12-30T21:29:21Z

1. Remove previous patch files, if any

← Older revision		Revision as of 21:29, 30 December 2021
Line 19:		Line 19:
	==== 1. Remove previous patch files, ''if any'' ====		==== 1. Remove previous patch files, ''if any'' ====

	If you applied patches previously, you may have log4j 2.15 or 2.16 files. They are likely under the /tmp directory, as per our instructions.		If you applied patches previously, you may have log4j 2.15, 2.16, or 2.17.0 files. They are likely under the /tmp directory, as per our instructions.
	* Navigate to /tmp		* Navigate to /tmp
	cd /tmp		cd /tmp
Line 27:		Line 27:
	rm -rf /tmp/apache-log4j-2.15.0-bin/		rm -rf /tmp/apache-log4j-2.15.0-bin/
	rm -rf /tmp/apache-log4j-2.16.0-bin/		rm -rf /tmp/apache-log4j-2.16.0-bin/
			rm -rf /tmp/apache-log4j-2.17.0-bin/


	If previous patches were not applied, this step is not necessary.		If previous patches were not applied, this step is not necessary.

Masnes at 21:17, 30 December 2021

2021-12-30T21:17:39Z

← Older revision		Revision as of 21:17, 30 December 2021
Line 11:		Line 11:
	Pending further action, Lingoport has shut down all non-critical systems.		Pending further action, Lingoport has shut down all non-critical systems.

	Critical systems have been patched to remove all copies of log4j 2.x with log4j 2.17 followed by a hard reboot.		Critical systems have been patched to remove all copies of log4j 2.x with log4j 2.17.1 followed by a hard reboot.

	=== For Lingoport Clients ===		=== For Lingoport Clients ===

	The below scripts may be used in conjunction to replace all log4j 2.x with log4j 2.17.		The below scripts may be used in conjunction to replace all log4j 2.x with log4j 2.17.1.

	==== 1. Remove previous patch files, ''if any'' ====		==== 1. Remove previous patch files, ''if any'' ====
Line 64:		Line 64:
	</pre>		</pre>

	==== 3. Retrieve log4j 2.17 ====		==== 3. Retrieve log4j 2.17.1 ====

	<pre>		<pre>
Line 106:		Line 106:

	if [[ ! -d /tmp/apache-log4j-2.17.1-bin/ ]] ; then		if [[ ! -d /tmp/apache-log4j-2.17.1-bin/ ]] ; then
	echo >&2 "Please retrieve apache log4j 2.17 and unzip it in /tmp before running this script"		echo >&2 "Please retrieve apache log4j 2.17.1 and unzip it in /tmp before running this script"
	exit 1		exit 1
	fi		fi
Line 142:		Line 142:
	user_group="$(stat -c "%U:%G" "$log4j_jar")"		user_group="$(stat -c "%U:%G" "$log4j_jar")"
	without_version="$(strip_version "$log4j_jar")"		without_version="$(strip_version "$log4j_jar")"
	patched_jar="$(basename "$without_version")2.17.0.jar"		patched_jar="$(basename "$without_version")2.17.1.jar"
	base_dir="$(dirname "$log4j_jar")"		base_dir="$(dirname "$log4j_jar")"
	echo "replace $log4j_jar ($user_group) - with $patched_jar"		echo "replace $log4j_jar ($user_group) - with $patched_jar"

Masnes: /* 4. Replace other log4j instances on your system with 2.17 */

2021-12-30T21:16:53Z

4. Replace other log4j instances on your system with 2.17

← Older revision		Revision as of 21:16, 30 December 2021
Line 72:		Line 72:
	</pre>		</pre>

	==== 4. Replace other log4j instances on your system with 2.17 ====		==== 4. Replace other log4j instances on your system with 2.17.1 ====

	The following script will replace vulnerable log4j libraries with 2.17. It searches your system for the vulnerable libraries, and replaces any that are found.		The following script will replace vulnerable log4j libraries with 2.17.1. It searches your system for the vulnerable libraries, and replaces any that are found.

	This script is designed to be run as root or via sudo.		This script is designed to be run as root or via sudo.
Line 105:		Line 105:
	}		}

	if [[ ! -d /tmp/apache-log4j-2.17.0-bin/ ]] ; then		if [[ ! -d /tmp/apache-log4j-2.17.1-bin/ ]] ; then
	echo >&2 "Please retrieve apache log4j 2.17 and unzip it in /tmp before running this script"		echo >&2 "Please retrieve apache log4j 2.17 and unzip it in /tmp before running this script"
	exit 1		exit 1
Line 114:		Line 114:
	continue		continue
	fi		fi
	if [[ "$log4j_jar" == "-2.17" ]] ; then		if [[ "$log4j_jar" == "-2.17.1" ]] ; then
	echo "Up to date: $log4j_jar"		echo "Up to date: $log4j_jar"
	continue		continue
Line 146:		Line 146:
	echo "replace $log4j_jar ($user_group) - with $patched_jar"		echo "replace $log4j_jar ($user_group) - with $patched_jar"
	set -x		set -x
	cp /tmp/apache-log4j-2.17.0-bin/"$patched_jar" "$base_dir" \|\| {		cp /tmp/apache-log4j-2.17.1-bin/"$patched_jar" "$base_dir" \|\| {
	set +x		set +x
	note_not_replaced "$log4j_jar"		note_not_replaced "$log4j_jar"

Masnes: /* 3. Retrieve log4j 2.17 */

2021-12-30T21:16:02Z

3. Retrieve log4j 2.17

← Older revision		Revision as of 21:16, 30 December 2021
Line 68:		Line 68:
	<pre>		<pre>
	cd /tmp/		cd /tmp/
	curl -O https://dlcdn.apache.org/logging/log4j/2.17.0/apache-log4j-2.17.0-bin.zip		curl -O https://dlcdn.apache.org/logging/log4j/2.17.1/apache-log4j-2.17.1-bin.zip
	unzip apache-log4j-2.17.0-bin.zip		unzip apache-log4j-2.17.1-bin.zip
	</pre>		</pre>

Masnes: /* 2. Check the status of your system before the fix */

2021-12-30T21:15:49Z

2. Check the status of your system before the fix

← Older revision		Revision as of 21:15, 30 December 2021
Line 48:		Line 48:
	continue		continue
	fi		fi
	if [[ "$log4j_jar" == "-2.17" ]] ; then		if [[ "$log4j_jar" == "-2.17.1" ]] ; then
	echo "Up to date: $log4j_jar"		echo "Up to date: $log4j_jar"
	continue		continue
Line 63:		Line 63:
	done <<< "$(find / -name 'log4j*.jar')"		done <<< "$(find / -name 'log4j*.jar')"
	</pre>		</pre>


	==== 3. Retrieve log4j 2.17 ====		==== 3. Retrieve log4j 2.17 ====

Olibouban: /* 1. Remove previous patch files, if any */

2021-12-21T16:46:10Z

1. Remove previous patch files, if any

← Older revision		Revision as of 16:46, 21 December 2021
Line 20:		Line 20:

	If you applied patches previously, you may have log4j 2.15 or 2.16 files. They are likely under the /tmp directory, as per our instructions.		If you applied patches previously, you may have log4j 2.15 or 2.16 files. They are likely under the /tmp directory, as per our instructions.
	* Navigate to /tmp ~~(cd /tmp)~~		* Navigate to /tmp
	cd /tmp		cd /tmp
	* Remove the files. For instance,		* Remove the files. For instance,
Line 28:		Line 28:
	rm -rf /tmp/apache-log4j-2.16.0-bin/		rm -rf /tmp/apache-log4j-2.16.0-bin/

	If previous patches were not applied, this step is not necessary.		If previous patches were not applied, this step is not necessary.

	==== 2. Check the status of your system before the fix ====		==== 2. Check the status of your system before the fix ====

Olibouban: /* For Lingoport Clients */

2021-12-21T14:45:51Z

For Lingoport Clients

← Older revision		Revision as of 14:45, 21 December 2021
Line 17:		Line 17:
	The below scripts may be used in conjunction to replace all log4j 2.x with log4j 2.17.		The below scripts may be used in conjunction to replace all log4j 2.x with log4j 2.17.

	0. Check if your system is vulnerable with the following script, which will search your system for vulnerable libraries.		==== 1. Remove previous patch files, ''if any'' ====

			If you applied patches previously, you may have log4j 2.15 or 2.16 files. They are likely under the /tmp directory, as per our instructions.
			* Navigate to /tmp (cd /tmp)
			cd /tmp
			* Remove the files. For instance,
			ls apache-log4j*.zip
			rm apache-log4j*.zip
			rm -rf /tmp/apache-log4j-2.15.0-bin/
			rm -rf /tmp/apache-log4j-2.16.0-bin/

			If previous patches were not applied, this step is not necessary.

			==== 2. Check the status of your system before the fix ====

			Check if your system is vulnerable with the following script, which will search your system for vulnerable libraries.

	This script is designed to be run as root, or via sudo:		This script is designed to be run as root, or via sudo:
Line 50:		Line 65:


	1. Retrieve log4j 2.17:		==== 3. Retrieve log4j 2.17 ====

	<pre>		<pre>
Line 58:		Line 73:
	</pre>		</pre>

	2. Replace other log4j instances on your system with 2.17		==== 4. Replace other log4j instances on your system with 2.17 ====

	The following script will replace vulnerable log4j libraries with 2.17. It searches your system for the vulnerable libraries, and replaces any that are found.		The following script will replace vulnerable log4j libraries with 2.17. It searches your system for the vulnerable libraries, and replaces any that are found.
Line 149:		Line 164:
	</pre>		</pre>

	3. You may wish to run the check script from #0 a second time to validate the fix.		==== 5. Check the status after the fix ====
			You may wish to run the check script from #1 a second time to validate the fix.
			Please note that the log4j 1.x are being worked on for our upcoming release (codename 'Ireland').


	4. Please reboot your system after replacing your libraries. This will ensure that the patch becomes fully effective.		==== 6. Please reboot your system ====
			Reboot your system after replacing your libraries. This will ensure that the patch becomes fully effective.

	== FATAL: Could not initialize class com.lingoport.common.velocity.LingoportVelocityWriter ==		== FATAL: Could not initialize class com.lingoport.common.velocity.LingoportVelocityWriter ==

Masnes: /* Apache Log4j Security Vulnerabilities */

2021-12-20T20:25:31Z

Apache Log4j Security Vulnerabilities

← Older revision		Revision as of 20:25, 20 December 2021
Line 82:		Line 82:
	note_not_replaced() {		note_not_replaced() {
	target="$1"		target="$1"

	if unzip -l "$log4j_jar" \| grep -q JndiLookup.class ; then		if unzip -l "$log4j_jar" \| grep -q JndiLookup.class ; then
	echo >&2 "unable to replace vulnerable $log4j_jar"		echo >&2 "unable to replace vulnerable $log4j_jar"
Line 143:		Line 144:
	if [[ "${exit_}" == "1" ]] ; then		if [[ "${exit_}" == "1" ]] ; then
	echo "Failed!"		echo "Failed!"
			exit 1
			fi

	</pre>		</pre>

Masnes at 17:54, 20 December 2021

2021-12-20T17:54:09Z

← Older revision		Revision as of 17:54, 20 December 2021
Line 11:		Line 11:
	Pending further action, Lingoport has shut down all non-critical systems.		Pending further action, Lingoport has shut down all non-critical systems.

	Critical systems have been patched to remove all copies of log4j 2.x with log4j 2.16 followed by a hard reboot.		Critical systems have been patched to remove all copies of log4j 2.x with log4j 2.17 followed by a hard reboot.

	=== For Lingoport Clients ===		=== For Lingoport Clients ===

	The below scripts may be used in conjunction to replace all log4j 2.x with log4j 2.16.		The below scripts may be used in conjunction to replace all log4j 2.x with log4j 2.17.

	0. Check if your system is vulnerable with the following script, which will search your system for vulnerable libraries.		0. Check if your system is vulnerable with the following script, which will search your system for vulnerable libraries.
Line 33:		Line 33:
	continue		continue
	fi		fi
	if [[ "$log4j_jar" == "-2.16" ]] ; then		if [[ "$log4j_jar" == "-2.17" ]] ; then
	echo "Up to date: $log4j_jar"		echo "Up to date: $log4j_jar"
	continue		continue
Line 50:		Line 50:


	1. Retrieve log4j 2.16:		1. Retrieve log4j 2.17:

	<pre>		<pre>
	cd /tmp/		cd /tmp/
	curl -O https://dlcdn.apache.org/logging/log4j/2.16.0/apache-log4j-2.16.0-bin.zip		curl -O https://dlcdn.apache.org/logging/log4j/2.17.0/apache-log4j-2.17.0-bin.zip
	unzip apache-log4j-2.16.0-bin.zip		unzip apache-log4j-2.17.0-bin.zip
	</pre>		</pre>

	2. Replace other log4j instances on your system with 2.16		2. Replace other log4j instances on your system with 2.17

	The following script will replace vulnerable log4j libraries with 2.16. It searches your system for the vulnerable libraries, and replaces any that are found.		The following script will replace vulnerable log4j libraries with 2.17. It searches your system for the vulnerable libraries, and replaces any that are found.

	This script is designed to be run as root or via sudo.		This script is designed to be run as root or via sudo.
Line 90:		Line 90:
	}		}

	if [[ ! -d /tmp/apache-log4j-2.16.0-bin/ ]] ; then		if [[ ! -d /tmp/apache-log4j-2.17.0-bin/ ]] ; then
	echo >&2 "Please retrieve apache log4j 2.16 and unzip it in /tmp before running this script"		echo >&2 "Please retrieve apache log4j 2.17 and unzip it in /tmp before running this script"
	exit 1		exit 1
	fi		fi
Line 99:		Line 99:
	continue		continue
	fi		fi
	if [[ "$log4j_jar" == "-2.16" ]] ; then		if [[ "$log4j_jar" == "-2.17" ]] ; then
	echo "Up to date: $log4j_jar"		echo "Up to date: $log4j_jar"
	continue		continue
Line 127:		Line 127:
	user_group="$(stat -c "%U:%G" "$log4j_jar")"		user_group="$(stat -c "%U:%G" "$log4j_jar")"
	without_version="$(strip_version "$log4j_jar")"		without_version="$(strip_version "$log4j_jar")"
	patched_jar="$(basename "$without_version")2.16.0.jar"		patched_jar="$(basename "$without_version")2.17.0.jar"
	base_dir="$(dirname "$log4j_jar")"		base_dir="$(dirname "$log4j_jar")"
	echo "replace $log4j_jar ($user_group) - with $patched_jar"		echo "replace $log4j_jar ($user_group) - with $patched_jar"
	set -x		set -x
	cp /tmp/apache-log4j-2.16.0-bin/"$patched_jar" "$base_dir" \|\| {		cp /tmp/apache-log4j-2.17.0-bin/"$patched_jar" "$base_dir" \|\| {
	set +x		set +x
	note_not_replaced "$log4j_jar"		note_not_replaced "$log4j_jar"