Hi Scott et al.
After the release of
https://www.ibm.com/support/pages/node/6526432?myns=swgother&mynp=OCSSQRZH&mync=E&cm_sp=swgother-_-OCSSQRZH-_-E it appears there are issues with 9.0.7.1 and 9.0.7.2.
With respect to the link above though, will there be any outage (automatic appliance/instance restarts) applying this?
The fix is there but documentation around it is lacking.
Any update would be appreciated.
All the best,
Tony
------------------------------
Tony Cooke
------------------------------
Original Message:
Sent: Tue December 14, 2021 05:22 PM
From: Scott Exton
Subject: ISAM use of log4j ?
Sylvain,
This is the official, and definitive, statement from IBM for ISAM/ISVA. We don't envisage any further updates as the in-depth investigation has been completed for the product.
Thanks.
Scott A. Exton
Senior Software Engineer
Chief Programmer - IBM Security Verify Access
IBM Master Inventor
Original Message:
Sent: 12/14/2021 4:52:00 PM
From: Sylvain Gilbert
Subject: RE: ISAM use of log4j ?
Hi Scott, does this technote means it is the definitive assessment for ISAM/ISVA, or some more updates could come in the next hours/days ?
Security Bulletin: IBM Security Access Manager 9.0.7.1 and IBM Security Verify Access 10.0.0.0 may be affected by the log4j vulnerability (CVE-2021-44228)
------------------------------
Sylvain Gilbert
Original Message:
Sent: Tue December 14, 2021 08:42 AM
From: Jesper James
Subject: ISAM use of log4j ?
Thank you, we can see that we have been hit with multiple exploit attempts already since the 11th of December. The bad guys move fast. You should too :D
------------------------------
Jesper James
PFA
004530950933
Original Message:
Sent: Mon December 13, 2021 02:55 PM
From: Scott Exton
Subject: ISAM use of log4j ?
Jesper,
IBM is still fully investigating the repercussions of the Log4J vulnerability and an official response should be published soon. I can however say that the reverse proxy itself is a C++ binary and does not embed any Java code, and as such will not be vulnerable. IBM is still investigating the impact on the Advanced Access Control and Federation offerings.
Thanks.
Scott A. Exton
Senior Software Engineer
Chief Programmer - IBM Security Verify Access
IBM Master Inventor
Original Message:
Sent: 12/13/2021 4:15:00 AM
From: Jesper James
Subject: RE: ISAM use of log4j ?
According the below page, ISAM is in fact using log4j. To what effect it does not state. Can you confirm that it is only used internally, and not for stuff like reverse proxy logfiles etc.?
https://www.ibm.com/support/pages/urgent-apar-information-ibm-security-access-manager-9072-firmware-upgrade
UPDATE TO MULTIPLE DEPENDENT SOFTWARE PRODUCTS
...
libpcap 1.5.3.11
log4j 2.13.2
nss-softokn 3.44.0.8
...
------------------------------
Jesper James
PFA
004530950933
Original Message:
Sent: Sun December 12, 2021 12:24 PM
From: Nick Lloyd
Subject: ISAM use of log4j ?
Hi André,
The ISAM v8/9 and ISVA v10 appliances are not affect by CVE-2021-44228.
At this time there is not an update to the X-Force signatures used by the embedded Web Application Firewall.
Junctioned applications should be updated per their vendors' instructions.
------------------------------
Nick
IBM Security Verify Customer Support
Original Message:
Sent: Fri December 10, 2021 07:47 AM
From: André Leruitte
Subject: ISAM use of log4j ?
Hello everybody,
Today a critical vulnerability was announced in Log4J widely used library : RCE 0-day exploit found in log4j, a popular Java logging package | LunaSec
As we have many java applications/product, we are trying to assess which assets could be vulnerable.
We are unable to find if ISAM/ISVA does use log4j library.
Does someone knows if there a place somewhere where this kind of dependencies are listed with their version ?
Thank you,
André
------------------------------
André Leruitte
------------------------------