Apache log4j Remote Code Execution Zero Day - Active Exploit

[Darius Panahy]

A remote-code execution vulnerability has been found in the Apache log4j logging library. 

This library is widely used in java applications and is used within the Rapide runtime. 

Rapide has been updated to include the latest 2.15.0 version of log4j and this is included in the following updated releases of the software which are now available to download:

• Rapide 3.0.2
  
• GuardIEn web client 8.8.0 (updated to show 8.8.0a in the home page)
  
• GuardIEn web client 8.7.5 (updated to show 8.7.5 in the home page)
  

Other platforms for example Windows clients or server software are not affected.

if you are using an earlier release of Rapide or the GuardIEn web client then it is highly recommended that you upgrade.

[Darius Panahy]

Further to the above posting, Rapide versions 2.0.2 and 3.0.3 are now available which update the log4j version to 2.16.0.

The GuardIEn web clients for 8.7.5 and 8.8.0 have also been updated to use log4j 2.16.0

[Darius Panahy]

Another version of the Apache log4j library has been released - version 2.17.0.

The following products have been updated to include 2.17.0:

• Rapide 2.0.3
  
• Rapide 3.0.4
  
• GuardIEn Web Client 8.7.5
  
• GuardIEn Web Client 8.8.0
  
• Studio Developer 8.7.5.0001
  
• Studio Developer 8.8.0.0001
  

[Darius Panahy]

We have analysed the Rapide runtime and the usage of log4j by third party utilities and have concluded that log4j is not required by Rapide. Therefore, to remove the need for further updates in the event that additional vulnerabilities are encountered and fixed in log4j, we have removed it from Rapide in version 3.0.5. This means that the following releases no longer use log4j:

• Rapide 3.0.5
  
• GuardIEn Web Client (8.7.5 and 8.8.0)
  
• Studio Developer (8.7.5.0001 and 8.8.0.0001)
  

Rapide 2.0 still contains (but does not use) log4j and is patched to version 2.17.0.

[m.b]

We have analysed the Rapide runtime and the usage of log4j by third party utilities and have concluded that log4j is not required by Rapide. Therefore, to remove the need for further updates in the event that additional vulnerabilities are encountered and fixed in log4j, we have removed it from Rapide in version 3.0.5. This means that the following releases no longer use log4j:

• Rapide 3.0.5
  
• GuardIEn Web Client (8.7.5 and 8.8.0)
  
• Studio Developer (8.7.5.0001 and 8.8.0.0001)
  

Rapide 2.0 still contains (but does not use) log4j and is patched to version 2.17.0.

Do I understand correctly that it is safe to remove file log4j-1.2.15.jar from C:\Program Files\IET\Client880\Studio\rapide\uk.co.iet.rapide.win32_3.0.0_lib after installing the DevOps Suite? We do not have a license for Rapide, so it's never used.

[Darius Panahy]

We have analysed the Rapide runtime and the usage of log4j by third party utilities and have concluded that log4j is not required by Rapide. Therefore, to remove the need for further updates in the event that additional vulnerabilities are encountered and fixed in log4j, we have removed it from Rapide in version 3.0.5. This means that the following releases no longer use log4j:

• Rapide 3.0.5
  
• GuardIEn Web Client (8.7.5 and 8.8.0)
  
• Studio Developer (8.7.5.0001 and 8.8.0.0001)
  

Rapide 2.0 still contains (but does not use) log4j and is patched to version 2.17.0.

Do I understand correctly that it is safe to remove file log4j-1.2.15.jar from C:\Program Files\IET\Client880\Studio\rapide\uk.co.iet.rapide.win32_3.0.0_lib after installing the DevOps Suite? We do not have a license for Rapide, so it's never used.

Yes, it can be removed.