Re: Remote code execution exploit found in Log4j .....

[Pete Helgren <pete@xxxxxxxxxx>]

As far as I know, and I have been reading and patching since last 
Saturday, the suspect jar is the core jar of log4j.  Since your jar is a 
log4j packaged for Apache Ant (a build tool) you would have to inspect 
the classes in the jar and see if it has the class that causes the 
vulnerability.  Specifically: 
org/apache/logging/log4j/core/lookup/JndiLookup.class   If it is there, 
it might be vulnerable if there is direct access to your laptop when the 
log4j jar can be leveraged (unlikely).

Check with the Apache Ant project to see if they posted something.

Pete Helgren
www.petesworkshop.com
GIAC Secure Software Programmer-Java
AWS Certified Cloud Practitioner
Microsoft Certified: Azure Fundamentals
Twitter - Sys_i_Geek  IBM_i_Geek

On 12/16/2021 6:56 PM, Jim Franz wrote:
> Using the link in Michael's post, IBM iAccess Family is listed as "not
> impacted". But using a search tool on my corporate laptop,
> C:\Program Files (x86)\IBM\Client
> Access\eclipse\plugins\org.apache.ant_1.6.2\lib\ant-apache-log4j.jar
>
> how do i resolve this?   I know this is a replaced product. Does the java
> client have the same? How would i know what version is in the plugin if IBM
> is only going to list it as "product not impacted".
> I have to answer to the security group within the company.
>
> btw - this was given to list the log4j jars on a Win machine.
> run the following command inside of PowerShell to find the file(s):
>
>   Get-ChildItem -Path C:\ "*log4j*" -Recurse -Force
> -ErrorAction SilentlyContinue | Where {$_.extension -like ".jar"} |
> select-object FullName
>
>
>
> Jim Franz