topic Re: log4j remediation in SAS Software for Learning Community

log4j remediation

muduki — Wed, 16 Feb 2022 13:57:22 GMT

Hello,

I am looking for some help with log4j remediation.

Once I run the below remediation script for the identified jar file, how to do I validate it?

zip -q -d path-to-JAR-file org/apache/logging/log4j/core/lookup/JndiLookup.class

Re: log4j remediation

AMSAS — Wed, 16 Feb 2022 15:58:05 GMT

Start here:

SAS Statement Regarding Remote Code Execution Vulnerability (CVE-2021-44228)

Re: log4j remediation

muduki — Mon, 21 Feb 2022 08:38:22 GMT

Thank you for the link. Yes, I gone through that earlier, but that gives the steps for remediation. I dont see any specific step for validation.

Would you mind to share if you are aware of any validation steps for manual log4j remediation?

Re: log4j remediation

jasonfor — Thu, 24 Mar 2022 21:57:38 GMT

For validation, I would rerun the search and if they were zipped, you shouldn't get any results for log4j-core-2.*.jar.

Re: log4j remediation

jasonfor — Thu, 24 Mar 2022 22:04:49 GMT

Is this the only command to issue for UNIX? zip -q -d path-to-JAR-file org/apache/logging/log4j/core/lookup/JndiLookup.class

Also does the path-to-JAR-file include the actual .jar file, for example what's in red (/opt/sas/sashome/SASEnvironmentManagerAgent/2.5/installer/lib/log4j-core-2.11.1.jar)

Thank you.

Re: log4j remediation

jasonfor — Fri, 25 Mar 2022 14:26:15 GMT

Correction:

The find command will still find those jar files. You want to verify that JndiLookup.class has been removed.

I think you can use something similar to this:

find . -name *.jar | xargs grep JndiLookup.class

Another way would be to spot check one or two jar files, by copying them to a temporary location, run “unzip jarfilename.jar”, and eyeball the extracted folder and see if JndiLookup.class is no longer there.