Precautionary steps to protect Log360 UEBA from Log4j vulnerabilities CVE-2021-45046, CVE-2021-44228, and CVE-2021-45105
In Log360 UEBA , the affected log4j version is used in the bundled dependency. Our security experts are analyzing the issue and as of now, we have no conclusive evidence of our product being affected by it. However, we strongly recommend all our customers to follow the below steps as a precautionary measure.
Stop Log360 UEBA service.
Navigate to <Log360 UEBA installation folder>\ES|lib where <Log360 UEBA installation folder> is the location where Log360 UEBA is installed in your machine.
Take a backup of the files log4j-1.2-api-2.9.1.jar, log4j-api-2.9.1.jar, and log4j-core-2.9.1.jar, and move them to a different folder other than the Log360 UEBA installation folder.
Navigate to <Log360 UEBA installation folder>\lib, take a backup of the file log4j-1.2.15, and move it to a different folder other than the Log360 UEBA installation folder. [Note : This file will be present only from version 4031]
Download the files in this link, extract the contents of the .zip file, and place them in the <Log360 UEBA installation folder>\ES\lib folder.
Start Log360 UEBA service.
Note: As per the latest update from Apache, there is no need to perform the previous workarounds (modifying jvm.options file and wrapper.conf files). Apache has released a .jar file which can mitigate against this vulnerability.
New to ADSelfService Plus?
Related Articles
ManageEngine Log360 - Security advisory regarding unauthenticated product integration vulnerability.
Hi, Some versions of Log360 have the unauthenticated change to integration system vulnerability, which was reported on Medium by Florian Hauser. This article explains how you can identify if your Log360 installation (including the add-ons) is ...