Security Notice: Apache Log4j Remote Code Execution (RCE) Log4shell Vulnerability (CVE-2021-44228, CVE-2021-45046, CVE-2021-45105)
First Published:12/14/2021
Last Updated:12/24/2021
NOTICE: SonicWall continues to assess the impact Log4j vulnerabilities have on its products and infrastructure, as utilization of Log4j does not immediately suggest exploitation is possible. Questions related to SonicWall infrastructure should be sent info@sonicwall.com.
The Apache Log4j project disclosed CVE-2021-44228, which is a critical (CVSS 10.0) remote code execution (RCE) vulnerability affecting Apache Log4j2<= 2.14.1. A security patch (Log4j 2.15.0) was released on December 10, 2021, and subsequent Log4j 2.16.0 and Log4j 2.17.0 versions to correct additional vulnerabilities (CVE-2021-45046, CVE-2021-45105).
- For the latest information regarding SonicWall products and Apache Log4j 2.x, please see PSIRT Advisory ID SNWLID-2021-0032.
- PSIRT is also tracking vulnerability CVE-2021-4104 related to Log4j 1.x and its impact on SonicWall products. Please reference PSIRT Advisory SNWLID-2021-0033 for updates regarding CVE-2021-4104 going forward.
The SonicWall Product Security Incident and Response Team (PSIRT) continues to review the impact this vulnerability has to SonicWall products. If your organization is using an affected product and end-user action is required, SonicWall will reach out to you directly with guidance.
| SonicWall Product (Appliance/Cloud/Virtual/On-Prem) | Status | Description |
|---|---|---|
| Email Security (ES) & Hosted Email Security (HES) | Impacted | Email Security (ES) 10.0.12 and earlier versions are impacted by Log4j vulnerabilities tracked via CVE-2021-44228 (ES 10.0.11 and earlier), CVE-2021-45046 and CVE-2021-45105. SonicWall has released SonicWall Email Security firmware 10.0.13 to include the updated Log4j2 2.17.0 that patches the above vulnerabilities. Hosted Email Security (HES) was patched automatically. IMPORTANT: All SonicWall customers using Email Security (On-Prem) devices should immediately log in to MySonicWall and upgrade to Email Security firmware 10.0.13, even if they previously upgraded to 10.0.12. For upgrade guidance, please review the KB article, "How do I upgrade firmware on an Email Security appliance?" |
| Network Security Manager (SaaS, On-Prem) | Impacted | SonicWall PSIRT review has determined NSM does use a vulnerable Log4j version. SonicWall has performed a comprehensive analysis of NSM that resulted in no observable attack vectors for the Log4j2 suite of vulnerabilities. However, to remove known or potential risk from customer environments, SonicWall has published NSM (On-Prem) firmware 2.3.2-R12-H2 to include Log4j 2.17.0, which addresses CVE-2021-45105 and CVE-2021-42550. As a precaution, NSM 2.3.2-R12-H2 also includes an upgrade to Logback 1.2.9 to address CVE-2021-42550. NSM (SaaS) was automatically patched to the latest firmware. IMPORTANT: All SonicWall customers using NSM (On-Prem) devices should immediately log in to MySonicWall and upgrade to 2.3.2-R12-H2, even if they previously upgraded to 2.3.2-R12-H1. For upgrade guidance, please review the KB article, "How do I upgrade on-prem Network Security Manager firmware?" |
| Web Application Firewall (WAF) | Partially Impacted | Additional review has found that WAF 3.x uses Log4j, but only when the legacy ‘Cloud Management’ feature is enabled. SonicWall recommends customers disable 'Cloud Management' if enabled. This change will not impact functionality. This feature is disabled by default. WAF 2.x and earlier versions do not use Log4j and are not impacted. Please follow the guidance in the dedicated KB article for changing this setting. |
Gen5 Firewalls (EOS)
| Not Impacted | Log4j2 not used in the appliance. |
Gen6 Firewalls
| Not Impacted | Log4j2 not used in the appliance. |
Gen7 Firewalls
| Not Impacted | Log4j2 not used in the appliance. |
SonicWall Switch
| Not Impacted | Log4j2 not used. |
SMA 100
| Not Impacted | Log4j2 not used. |
SMA 1000
| Not Impacted | Version 12.x not using vulnerable Log4j version. |
| MySonicWall (MSW) | Not Impacted | Log4j2 not used. |
| Analyzer | Not Impacted | Version Analyzer 1.x is not using the vulnerable Log4j version. |
| GMS | Not Impacted | GMS version 9.x and 8.x are not using the vulnerable Log4j version. |
| Capture Client & Capture Client Portal | Not Impacted | Log4j2 not used. |
| CAS | Not Impacted | Log4j2 not used. |
| Access Points | Not Impacted | Log4j2 not used. |
| Wireless Network Manager (WNM) | Not Impacted | Log4j2 not used. |
| Capture Security Appliance | Not Impacted | Log4j2 not used. |
WXA
| Not Impacted | WXA is not using the vulnerable Log4j version. |
| CSCMA | Not Impacted | CSCMA is not using the vulnerable Log4j version. |
| EPRS | Not Impacted | EPRS 1.x and 2.x are not using the vulnerable Log4j version. |
| Cloud Edge | Not Impacted | Cloud Edge is not using the vulnerable Log4j version. |
| Analytics | Not Impacted | Analytics is not using the vulnerable Log4j version. |
While there are no signs of active exploitation on SonicWall products, SonicWall urges organizations using Apache Log4j to patch immediately. The industry is observing coinminers, remote access trojans (RAT) and Cobalt Strike payloads being actively deployed against vulnerable servers.
SonicWall threat research teams have released the following the IPS and WAF signatures to help detect attacks exploiting these vulnerabilities.
- 2307 Apache Log4j2 JNDI Log Messages Remote Code Execution
- 18198 Apache Log4j2 JNDI Log Messages Remote Code Execution LDAPS
- 18199 Apache Log4j2 JNDI Log Messages Remote Code Execution NIS
- 18200 Apache Log4j2 JNDI Log Messages Remote Code Execution NDS
- 18201 Apache Log4j2 JNDI Log Messages Remote Code Execution COBRA
- 18202 Apache Log4j2 JNDI Log Messages Remote Code Execution RMI
- 18203 Apache Log4j2 JNDI Log Messages Remote Code Execution IIOP
- 18204 Apache Log4j2 JNDI Log Messages Remote Code Execution DNS 2
- 2311 Apache Log4j2 JNDI Log Messages Remote Code Execution HTTP
- 2315 Apache Log4j2 JNDI Log Messages Remote Code Execution DNS
- 2328 Apache Log4j2 JNDI Log Messages Remote Code Execution HTTPS
- 1116 Apache Log4j2 JNDI Log Messages Remote Code Execution
Resources:
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0033
- https://securitynews.sonicwall.com/xmlpost/apache-log4j-rce-vulnerability/
- https://logging.apache.org/log4j/2.x/security.html
- https://nvd.nist.gov/vuln/detail/CVE-2021-44228
- https://nvd.nist.gov/vuln/detail/CVE-2021-45046
- https://nvd.nist.gov/vuln/detail/CVE-2021-45105
- https://www.cisa.gov/uscert/apache-log4j-vulnerability-guidance
