# MA-825.122021: MyCERT Advisory - Remediation and Mitigation for Apache Java Logging Library (Log4j) vulnerability

**Date:** 21 Mar 2022  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-825.122021  
**Advisory ID:** MA-825.122021

---

**1.0 Introduction**
The Apache Software Foundation has released a security advisory to address a remote code execution vulnerability (CVE-2021-44228) affecting Log4j versions 2.0-beta9 to 2.14.1. A remote attacker could exploit this vulnerability to take control of an affected system. Log4j is an open-source, Java-based logging utility widely used by enterprise applications and cloud services.
December 14th, the Apache Software Foundation announced a new vulnerability in Log4j (CVE-2021-45046) to address Log4j version 2.15.0 did not fully mitigate the (CVE-2021-44228) vulnerability with certain non-default configurations, potentially causing a denial-of-service attack. Furthermore, security companies exposed that Log4j version 2.15.0 can still allow for the exfiltration of sensitive data in certain circumstances[11].
**[First update]:** all versions of Apache log4j from 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 are listed as being vulnerable to a new CVE - CVE-2021-45046. [5]
**[Second update]:** Apache log4j2 versions 2.0-alpha1 through 2.16.0 were found vulnerable to a new CVE - CVE-2021-45105. [5]
**[Third update]:** Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) were found vulnerable a new CVE - CVE-2021-44832. [5]
**2.0 Impact**
Exploiting these vulnerabilities may allow an attacker to take control of an affected system remotely, conduct denial of service (DOS) attacks and data exfiltration.
**3.0 Affected Products**
|  |
| --- | --- | --- | **Log4j CVEs** | | **CVE** | **Impact** | **Reference** | CVE-2021-44228 | >=2.0-beta9 through 2.12.1 >=2.13.0 through 2.15.0   Consult with your product's, or systems' vendor to verify the vulnerability issue. | 1. [Vulnerable Log4j Hashes (bundle release version only)](https://gist.githubusercontent.com/xanda/a2607a5715d9197fc4bb7005b1c51d41/raw/0a6089fca61eed95f02d2a86b3704814d4c4f094/vulnerable_log4j-core_hashes.csv) 2. [Vulnerable JNDILookup.class Hashes](https://gist.githubusercontent.com/xanda/7ac663984f3560f0b39b18437362d924/raw/79d765296634c0407db99763d0b2c7c318e30078/Vulnerable_JndiLookup_class_hashes.csv) 3. [List of products that is affected by CVE-2021-44228](https://github.com/cisagov/log4j-affected-db): A repository of publicly available information and vendor-supplied advisories regarding the Log4j vulnerability maintained by Cybersecurity and Infrastructure Security Agency, (CISA). | CVE-2021-45046 | >=2.0-beta9 through 2.12.1 >=2.13.0 through 2.15.0 | Proof of concept by [The Praetorian](https://www.praetorian.com/blog/log4j-2-15-0-stills-allows-for-exfiltration-of-sensitive-data/) | CVE-2021-45105 | >=2.0-alpha1 through 2.16.0 (excluding 2.12.3) | Proof of concept by [The Zero Day Initiative (ZDI)](https://www.zerodayinitiative.com/blog/2021/12/17/cve-2021-45105-denial-of-service-via-uncontrolled-recursion-in-log4j-strsubstitutor) | CVE-2021-44832 | >=2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) | Proof of concept by [The Cyber Kendra](https://www.cyberkendra.com/2021/12/fourth-log4j-rce-vulnerability.html) |
**4.0 Recommendations**
MyCERT strongly urges users and administrators to do as follows for **protection** against the vulnerability:
Users of Apache Log4j affected versions are advised to upgrade to the latest version immediately.
- **[Initial release]:** Apache log4j-2.16.0 is available and is the recommended patch level to address CVE-2021-44228 and CVE-2021-45046. [5] [12]
- **[First update]:** Apache log4j 2.12.2 (Java 7) and log4j 2.16.0 (Java 8) was released to address CVE-2021-45046. [5]
- **[Second update]:** Apache log4j 2.17.0 (Java 8) was released to address CVE-2021-45105. [5]
- **[Third update]:** Apache log4j 2.17.1 (Java 8), 2.12.4 (Java 7) and 2.3.2 (Java 6) was released to address CVE-2021-44832. [5]
Prior to upgrading, it is advisable to check whether the systems use the ThreadContext class (JndiLookup) to avoid system disruption. If the class is not being used, feel free to upgrade.
MyCERT strongly urges users and administrators to do as follows for **mitigation** against the vulnerability:
- If unable to patch or upgrade, try to locate the log4j folder and JNDIlookup.class file being installed in systems. For the Unix-based system, a bash script can be used provided by a security researcher[8].
The files can be found in the temp folder under the log4j-jar-files.txt. After locating both items, compare them with hashes listed in section 3 of this advisory. If the hashes match, proceed to the next step for mitigation and removal.
- For Unix based system, the JndiLookup class can be removed using the code below:
- For a Windows-based system, we proposed to use antivirus to scan and mitigate the vulnerable files. The hashes provided in section 3 can be used as custom indicators in your antivirus solution. Antivirus will be able to parse the JAR (zip) file and delete specific hashes (JndiLookup.class) while ignoring other files. However, it is strongly advised to consult your antivirus vendor for confirmation before proceeding with this technique[8].
Generally, MyCERT advises users of the product devices to be updated with the latest security announcements by the vendors and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
1. <https://www.cisa.gov/uscert/ncas/current-activity/2021/12/10/apache-releases-log4j-version-2150-address-critical-rce>
2. [https://auscert.org.au/bulletins/ASB-2021.0244](https://www.cisa.gov/uscert/ncas/current-activity/2021/12/10/apache-releases-log4j-version-2150-address-critical-rce)
3. <https://www.lunasec.io/docs/blog/log4j-zero-day/>
4. [https://www.randori.com/blog/cve-2021-44228/](https://www.lunasec.io/docs/blog/log4j-zero-day/)
5. <https://logging.apache.org/log4j/2.x/security.html>
6. <https://logging.apache.org/log4j/2.x/download.html>
7. <https://blog.xanda.org/2021/12/14/using-antivirus-to-scan-for-vulnerable-lib4j-and-apply-mitigation/>
8. <https://blog.xanda.org/2021/12/12/bash-script-to-locate-log4j-core-and-delete-jndilookup-class/>
9. <https://www.cisa.gov/uscert/apache-log4j-vulnerability-guidance>
10. <https://www.mandiant.com/resources/log4shell-recommendations#_Temporary_Mitigations>
11. <https://www.praetorian.com/blog/log4j-2-15-0-stills-allows-for-exfiltration-of-sensitive-data/>
12. <https://github.com/apache/logging-log4j2/releases/tag/rel/2.16.0>
13. <https://www.zerodayinitiative.com/blog/2021/12/17/cve-2021-45105-denial-of-service-via-uncontrolled-recursion-in-log4j-strsubstitutor>
14. <https://www.cyberkendra.com/2021/12/fourth-log4j-rce-vulnerability.html>