RE: Remote code execution exploit found in Log4j

You're missing my point.
I am not at all expecting a solution - I expect them to be forthcoming, not dance around the issue.
As a developer, I would tell a customer to cease using the product until I could discern whether my product was vulnerable.

So until they can tell me something, Web Query access is blocked at our firewall.

Having been through a ransomware attack, my attitude is much different than most.

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Jim Oberholtzer
Sent: Monday, December 13, 2021 4:20 PM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: Re: Remote code execution exploit found in Log4j - CVE-2021-44228

IBM has to look in the several thousand places where that code could be
found. That's just IBMi and LPPs and utilities, not to mention the other
software/hardware products. That's not going to happen in several
hours. Then when/if they find it they have to decide what to do about it.
Has Apache even posted a fix for it yet? I understand your frustration,
however as a developer you know that sometimes you are faced with an issue
that you need to think about before you come to a suitable solution.
--
Jim Oberholtzer
Chief Technical Architect
Agile Technology Architects

On Mon, Dec 13, 2021 at 2:53 PM Greg Wilburn <
gwilburn@xxxxxxxxxxxxxxxxxxxxxxx> wrote:

Jim,

I wouldn't have believed it unless I experienced it myself.

If that's the case then why not answer me by saying "We don't know for
sure, but we're looking into it as quickly as possible".

It's the way they are answering me (or not) that is making me furious...
reminds me of a White House press conference.

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Jim
Oberholtzer
Sent: Monday, December 13, 2021 3:02 PM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: Re: Remote code execution exploit found in Log4j - CVE-2021-44228

I don't know if IBM is evasive, or if they don't really know
definitively yet, I'm going with the latter at this point. Also IBM tends
to release the PTFs when they announce the vulnerability as well, so I'll
bet there are developers working to identify and correct anything they need
to.

That logging is usually called out as a java class, ie:

package org.apache.logging; import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.apache.logging.log4j.Marker;

It could be used in 1000s of places, or none. We have to wait for more
information.

--
Jim Oberholtzer
Chief Technical Architect
Agile Technology Architects

On Mon, Dec 13, 2021 at 9:41 AM Greg Wilburn <
gwilburn@xxxxxxxxxxxxxxxxxxxxxxx> wrote:

IBM Support's response is to push you to the blog
https://www.ibm.com/blogs/psirt/

Which then references the link below. Nothing in the link below tells me
anything about the IBM i specifically. I added the environment variable
and restarted DB2 Web Query. But beyond that, the steps are Greek to me.

The only application we have externally facing is DB2 Web Query. I asked
if it was affected... support just keeps reiterating "our only
communication is via the blog"

I have never seen IBM support so "evasive" about an issue.

RE: Remote code execution exploit found in Log4j - CVE-2021-44228