cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

LOG4J and MWG

Jump to solution

Hi!
I'm sure everyone is already aware of the new vulnerability (including McAfee; I am following the KB), but there's no word on MWG impact in there just yet.

MWG ver. 9.2.14 ships with log4j-core-2.13.2.jar & log4j-api-2.13.2.jar.
Within my understanding this classifies it as vulnerable.

Do we have any mitigations we could perform? The ones in the McAfee KB only apply to versions older than 2.10.*, what do we do here?
I did read about setting an environmental variable "LOG4J_FORMAT_MSG_NO_LOOKUPS" to "true", is there any implication with general functionality of MWG?

Thank you

2 Solutions

Accepted Solutions
marcus69
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 4 of 16

Re: LOG4J and MWG

Jump to solution

A new Release is being planned, presumably including a Hotfix:

2021-12-14 08_28_03-MWG-Log4j-Fix.jpg

See https://kc.mcafee.com/agent/index?page=content&id=SB10377

Best regards
   Marcus

P.S.: If you find this post helpful, thank You for giving it a Kudo :o)

View solution in original post

jacek
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 9 of 16

Re: LOG4J and MWG

Jump to solution

Official release notes are still in progress. They should be posted in next 24h.

 

Info from yum update:

mwg.x86_64                    10.2.5-39162.mlos3.mwg  mlos-main-gen_release-base
mwg-config.x86_64             10.2.5-39162.mlos3.mwg  mlos-main-gen_release-base
mwg-mfetsc.x86_64             10.2.5-39162.mlos3.mwg  mlos-main-gen_release-base
mwg-release.noarch            10.2.5-39162.mlos3.mwg  mlos-main-gen_release-base
mwg-ui.noarch                 10.2.5-39162.mlos3.mwg  mlos-main-gen_release-base

 

View solution in original post

15 Replies
marcus69
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 2 of 16

Re: LOG4J and MWG

Jump to solution

Hi @luka_hajnrihar 

according to the following KB Article, MWG is not exploitable in terms of the log4j vulnerability:
https://kc.mcafee.com/corporate/index?page=content&id=KB95091

Best regards
    Marcus 

P.S.: If you find this post helpful, thank You for giving it a Kudo :o)

Re: LOG4J and MWG

Jump to solution
Hi,

Status Updated from "Not Impacted/Not Exploitable" to "Under Review".

Version: 10.2.4.

WEB-INF/classes/log4j2.xml
WEB-INF/lib/log4j-api-2.13.2.jar
WEB-INF/lib/log4j-slf4j-impl-2.13.2.jar
WEB-INF/lib/log4j-core-2.13.2.jar
WEB-INF/lib/log4j-web-2.13.2.jar
marcus69
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 4 of 16

Re: LOG4J and MWG

Jump to solution

A new Release is being planned, presumably including a Hotfix:

2021-12-14 08_28_03-MWG-Log4j-Fix.jpg

See https://kc.mcafee.com/agent/index?page=content&id=SB10377

Best regards
   Marcus

P.S.: If you find this post helpful, thank You for giving it a Kudo :o)

Re: LOG4J and MWG

Jump to solution

Mitigation steps are only available to register McAfee customers.

Re: LOG4J and MWG

Jump to solution
 

CorretionPrediction.jpg

 

jacek
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 7 of 16

Re: LOG4J and MWG

Jump to solution
10.2.5 was released right now. You can update your system with 'yum update'.

Re: LOG4J and MWG

Jump to solution

Wow thanks for the notification.
Where's the release article though or are you just surfing through repositories?

 

jacek
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 9 of 16

Re: LOG4J and MWG

Jump to solution

Official release notes are still in progress. They should be posted in next 24h.

 

Info from yum update:

mwg.x86_64                    10.2.5-39162.mlos3.mwg  mlos-main-gen_release-base
mwg-config.x86_64             10.2.5-39162.mlos3.mwg  mlos-main-gen_release-base
mwg-mfetsc.x86_64             10.2.5-39162.mlos3.mwg  mlos-main-gen_release-base
mwg-release.noarch            10.2.5-39162.mlos3.mwg  mlos-main-gen_release-base
mwg-ui.noarch                 10.2.5-39162.mlos3.mwg  mlos-main-gen_release-base

 

Re: LOG4J and MWG

Jump to solution

Hi, yup

I've already pushed our lab machine to the patch.
Happy to see log4j 2.16.0 included.

 

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community