LOG4J and MWG

[luka_hajnrihar]

Hi!
I'm sure everyone is already aware of the new vulnerability (including McAfee; I am following the KB), but there's no word on MWG impact in there just yet.

MWG ver. 9.2.14 ships with log4j-core-2.13.2.jar & log4j-api-2.13.2.jar.
Within my understanding this classifies it as vulnerable.

Do we have any mitigations we could perform? The ones in the McAfee KB only apply to versions older than 2.10.*, what do we do here?
I did read about setting an environmental variable "LOG4J_FORMAT_MSG_NO_LOOKUPS" to "true", is there any implication with general functionality of MWG?

Thank you

[marcus69]

Hi @luka_hajnrihar 

according to the following KB Article, MWG is not exploitable in terms of the log4j vulnerability:
https://kc.mcafee.com/corporate/index?page=content&id=KB95091

Best regards
    Marcus 

[sodanieloliveir]

Hi,

Status Updated from "Not Impacted/Not Exploitable" to "Under Review".

Version: 10.2.4.

WEB-INF/classes/log4j2.xml
WEB-INF/lib/log4j-api-2.13.2.jar
WEB-INF/lib/log4j-slf4j-impl-2.13.2.jar
WEB-INF/lib/log4j-core-2.13.2.jar
WEB-INF/lib/log4j-web-2.13.2.jar

[marcus69 · Accepted solution]

A new Release is being planned, presumably including a Hotfix:

See https://kc.mcafee.com/agent/index?page=content&id=SB10377

Best regards
   Marcus

[Glenn_Bolton]

Mitigation steps are only available to register McAfee customers.

[sodanieloliveir]

[jacek]

10.2.5 was released right now. You can update your system with 'yum update'.

[luka_hajnrihar]

Wow thanks for the notification.
Where's the release article though or are you just surfing through repositories?

[jacek · Accepted solution]

Official release notes are still in progress. They should be posted in next 24h.

Info from yum update:

mwg.x86_64                    10.2.5-39162.mlos3.mwg  mlos-main-gen_release-base
mwg-config.x86_64             10.2.5-39162.mlos3.mwg  mlos-main-gen_release-base
mwg-mfetsc.x86_64             10.2.5-39162.mlos3.mwg  mlos-main-gen_release-base
mwg-release.noarch            10.2.5-39162.mlos3.mwg  mlos-main-gen_release-base
mwg-ui.noarch                 10.2.5-39162.mlos3.mwg  mlos-main-gen_release-base

[luka_hajnrihar]

Hi, yup

I've already pushed our lab machine to the patch.
Happy to see log4j 2.16.0 included.