DSA-2021-286: Dell EMC Power Protect Data Manager Security Update for Apache Log4j Remote Code Execution Vulnerability (CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832)

Impact

Critical

Details

Affected Products and Remediation

Workarounds and Mitigations

Short-Term Mitigation for Power Protect Data Manager:

For all supported Power Protect Data Manager (PPDM) versions, follow the steps below: 

1. Disable all policies, and wait for any running jobs to complete.

2. SSH to host using admin account: 

ssh <host> -l admin

3. Run the following command: 

echo "-Dlog4j2.formatMsgNoLookups=true" >> /etc/elasticsearch/jvm.options

4. Run the following command:

echo "
#! /bin/sh
/usr/local/brs/puppet/scripts/ecdm_services.sh stop
if [ -d /usr/local/brs/lib/mvnrepo/repository/org/apache/logging/log4j/log4j-core ]; then
zip -q -d /usr/local/brs/lib/mvnrepo/repository/org/apache/logging/log4j/log4j-core/2.*/log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class
fi
if [ -d /usr/share/elasticsearch/lib ]; then
zip -q -d /usr/share/elasticsearch/lib/log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class
fi
/usr/local/brs/puppet/scripts/ecdm_services.sh start
" > /tmp/fixlog4j.sh ;  chmod u+x /tmp/fixlog4j.sh

5. Run the following command:

sudo /tmp/fixlog4j.sh

6. Enable all policies back.

Note: It make take several minutes (up to 5 or longer) for all services to restart.

Short-Term Mitigation for Power Protect Data Manager Search:

Skip this step if you have not deployed Search Node.

1. SSH to PPDM Core OVA using admin account and change to the root user.

2. Run the following command to get the search node credentials:

source /opt/emc/vmdirect/unit/vmdirect.env && /opt/emc/vmdirect/bin/infranodemgmt get -secret

3. SSH to the first Search node with "admin" account using the following command:

 ssh admin@<search FQDN or IP>

4. Run the following command to update the jvm options:

echo "-Dlog4j2.formatMsgNoLookups=true" >> /etc/elasticsearch/jvm.options

5. Run the following command to create a script to remove the java class that has the exploit:

echo "
if [ -d /usr/share/elasticsearch/lib ]; then
zip -q -d /usr/share/elasticsearch/lib/log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class
fi
sudo systemctl restart elasticsearch
" > /tmp/fixlog4j.sh ;  chmod u+x /tmp/fixlog4j.sh

6. Run the following command to run the script that is created through step 5 above:

sudo /tmp/fixlog4j.sh

7. Repeat steps from #3 to #6 for all the additional Search nodes found in step #2.

Note: It is recommended not to add additional Search Nodes until the next release with the fix is added. If any nodes are added before the fix, these mitigation steps must be added on the new Search Nodes as well.


Short-Term Mitigation for Power Protect Data Manager Cloud DR:

Skip this step if you have not enabled and configured Cloud DR.

For Cloud DR Server Deployed on cloud (AWS, AZURE, AWS GOV, or AZURE GOV)

1. Log in to the CDRS over SSH. For assistance in accessing CDRS over SSH, contact Dell Support.

2. Create cdrs_log4jfix.sh in /tmp/ directory with following content:

#! /bin/sh
cdr_backup()
{
  mkdir -p /tmp/cdr_backup
  cp /home/cdr/executable /tmp/cdr_backup/executable.bak
  cp /home/cdr/resources/restore_service.tar.gz /tmp/cdr_backup/restore_service.tar.gz.bak
  cp /home/cdr/lib/cdrs_main.jar /tmp/cdr_backup/cdrs_main.jar.bak
}
update_executable()
{
  echo "Updating CDRS executable."
  sed -i 's/=CDRS/=CDRS -Dlog4j2.formatMsgNoLookups=true/g' /home/cdr/executable
}
update_restore_service()
{
  L_CDR_VER=$1
  echo "Updating restore_service.jar."
  BASE_PATH=/home/cdr/resources
  cd $BASE_PATH
  gunzip restore_service.tar.gz
  tar -xvf restore_service.tar lib_${L_CDR_VER}/restore_service.jar
  if [[ ${L_CDR_VER} =~ 19\.[6-9] ]]; then
     zip -q -d lib_${L_CDR_VER}/restore_service.jar shadow/org/apache/logging/log4j/core/lookup/JndiLookup.class
  fi
  zip -q -d lib_${L_CDR_VER}/restore_service.jar org/apache/logging/log4j/core/lookup/JndiLookup.class
  tar --delete -f restore_service.tar lib_${L_CDR_VER}/restore_service.jar
  tar -uf restore_service.tar lib_${L_CDR_VER}/restore_service.jar
  rm -rf lib_${L_CDR_VER}
  gzip restore_service.tar
}
update_cdrs_main()
{
  echo "Updating cdrs_main.jar."
  LOG4J_JAR_FILE_LOCATION=BOOT-INF/lib/log4j-core-2.13.2.jar
  echo "Stopping CDR service."
  sudo service cdrd stop
  cd /home/cdr/lib/
  mkdir -p BOOT-INF/lib
  unzip -p cdrs_main.jar $LOG4J_JAR_FILE_LOCATION > $LOG4J_JAR_FILE_LOCATION
  zip -q -d $LOG4J_JAR_FILE_LOCATION org/apache/logging/log4j/core/lookup/JndiLookup.class
  zip -u -0 -n *.jar cdrs_main.jar $LOG4J_JAR_FILE_LOCATION
  rm -rf BOOT-INF
  echo "Starting CDR service. This may take a few minutes."
  sudo service cdrd start
  for i in {1..10}
  do
    sleep 30
    echo "Checking CDR service status..."
    RESP_CODE=$(curl -kfsL -o /dev/null -w '%{http_code}' -X GET https://localhost/rest/cdr-version -H "accept: application/json")
    if [[ "$RESP_CODE" == 200 ]]; then
      echo "CDR service started successfully."
      return 0
    fi
  done
  echo "Failed to run CDR service. Please contact Dell Support."
  exit 1
}
main()
{
   cdr_backup
   CDR_VER=$(curl -s -X GET https://localhost/rest/cdr-version -H "accept: application/json" -k)
   echo "CDR version is : $CDR_VER"
   if [[ $CDR_VER =~ 19\.[6-9] ]]; then
      update_executable
      update_restore_service $CDR_VER
      update_cdrs_main
    elif ([[ $CDR_VER =~ 19\.[2-5] ]] || [[ $CDR_VER =~ 19\.1\.[0-9] ]]); then
      update_restore_service $CDR_VER
    else
      echo "This script is applicable only for CDR versions between 19.1 and 19.9."
      exit 1
    fi
    rm -rf /tmp/cdr_backup
}
main

3. Execute the commands below:

• dos2unix /tmp/cdrs_log4jfix.sh

• chmod +x /tmp/cdrs_log4jfix.sh

• sudo /tmp/cdrs_log4jfix.sh

Revision History

Related Information

Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide