Log4j2 on 5.0.19

Server Administration
21

I have too have sent emails to support this weekend and also via the support contact forms. I would have to imagine they are aware of this issue. Anyone in IT has to be aware of it.

22

Iā€™m on the latest version and Iā€™ve run the tool:

PS C:\Windows\system32> S:\temp\log4j2-scan.exe "C:\Program Files\SimpleHelp"
scan error: invalid END header (bad central directory offset)
scan error: invalid END header (bad central directory offset)
scan error: invalid END header (bad central directory offset)

Scanned 507 directories and 8318 files
Found 0 vulnerable files
Completed in 2.34 seconds
PS C:\Windows\system32>
23

One would think, wouldnā€™t one

24

As Evan mentioned further up this thread it the log4 stuff is baked into SH so I am wondering if tools like logpresso would pick up the vulnerabilities

strings /opt/SimpleHelp/lib/commons-logging.jar | grep -i log4j
org/apache/commons/logging/impl/Log4JCategoryLog.class
org/apache/commons/logging/impl/Log4JLogger.class
org/apache/commons/logging/impl/Log4jFactory.class
org/apache/commons/logging/impl/Log4JCategoryLog.classPK
org/apache/commons/logging/impl/Log4JLogger.classPK
org/apache/commons/logging/impl/Log4jFactory.classPK

25

I wonder about the software on end user machines.

26

Soā€¦ not ideal but i rely on SH at the moment.

I have setup firewall rules to only allow the IP addresses of our hosts and computers to access the server.

Not ideal, and a pain for dynamic IP users (home users). You just have to ask for their IP to allow list before supporting them if you need to.

Also theres nothing to say it cant be attacked from a users machine. Seems unlikely, but possible.

Hopefully my week wont be a nightmare as this is the only Java based product we use.

Hopefully SH will confirm or deny vulnerability and release a patch if needed soon.

1 Like
27

I presume you have no WAN ports pointed to it.

28

Be careful btw, donā€™t lock yourself out.

29

So far the agent installed on user systems has not popped up in any scans from services like crowdstrike, huntress, sophos, etc. So I am really hoping the software is not vulnerable. It would be a nightmare.

1 Like
30

I just heard from support. See below

ā€œSimpleHelp does not utilise Log4J so its not vulnerable to exploit (CVE-2021-44228). We do not expect any version of SimpleHelp to be affected in any way.ā€

3 Likes
31

Thatā€™s a little bit of good news :slight_smile:

33

Thank you for all the communication, and especially for posting the confirmation that SH isnā€™t affected. Right after making this thread, my account was temporarily suspended, so I couldnā€™t reply to anyone. But Iā€™ve been following the discussion all weekend, Thanks, all.

34

Just to clarify - those are the apache commons logging interfaces to log4j. Not log4j itself. SH has posted a new thread on this topic and have confirmed that the product is not susceptible to (CVE-2021-44228) - Log4J Vulnerability (CVE-2021-44228) and SimpleHelp

1 Like