Vulnerability new update - ManageEngine Data Security Plus

Vulnerability new update - ManageEngine Data Security Plus

This post is a follow up for two high severity vulnerabilities (CVE- 2021-44228/CVE-2021-45046) reported in Apache and the recommended countermeasure to mitigate them (Replacing the old jar files with log4j files of v2.16). It is observed that there is another susceptible vulnerability (Code name: CVE-2021-45105) discovered for which there has been NO substantial evidence of any successful and possible exploitation in Data Security Plus. However, the affected log4j version is used in the application in the bundled dependency, so we strongly recommend all our customers to follow the below steps to fix the vulnerability. 

Note: This procedure is also applicable for the previously recorded vulnerabilities (CVE- 2021-44228/CVE-2021-45046/) along with CVE-2021-45105 irrespective of the application's current build number.

1. Stop the ManageEngine DataSecurity Plus service and wait till it stops.
2. In case the ManageEngine DataSecurity Plus DataEngine service does not stop automatically, stop it manually.

3. Move(cut and paste) the below jar files from '\apps\dataengine-xnode\lib' to any backup location outside the product installation path.

log4j-api-2.10.0.jar
log4j-core-2.10.0.jar
log4j-iostreams-2.10.0.jar
log4j-slf4j-impl-2.10.0.jar

(or)
 
log4j-api-2.16.0.jar
log4j-core-2.16.0.jar
log4j-iostreams-2.16.0.jar
log4j-slf4j-impl-2.16.0.jar

4. Download jar files from the below link:
https://downloads.zohocorp.com/DataSecurity_Plus/OHCNtqR9x9FrK0f/log4j-2.17.0.zip

5. Copy the downloaded jar files to '\apps\dataengine-xnode\lib'.
6. Start the ManageEngine DataSecurity Plus service. 

Last updated date: 20 Dec 2021 
Time: 9AM IST

Many Thanks,
Data Security Plus Team