SB2022010514 - Remote code execution in IBM Sterling Global Mailbox (Apache Log4j component)

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022010514

SB2022010514 - Remote code execution in IBM Sterling Global Mailbox (Apache Log4j component)

Published: January 5, 2022

Security Bulletin ID SB2022010514
Severity
High
Patch available
NO
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Code Injection (CVE-ID: CVE-2021-45046)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incomplete patch in Apache Log4j 2.15.0 for a code injection vulnerability #VU58816 (CVE-2021-44228) in certain non-default configurations. A remote attacker with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) can pass malicious data using a JNDI Lookup pattern and perform a denial of service (DoS) attack, exfiltrate data or execute arbitrary code.

Later discovery demonstrates a remote code execution on macOS but no other tested environments.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References